File name:

MoE Chemistry Setup.exe

Full analysis: https://app.any.run/tasks/abbaa868-4d52-4eaf-b946-169b8ef13e97
Verdict: Malicious activity
Analysis date: November 03, 2023, 15:33:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

52E63AA5752EFC1CDAB9EB48913A5441

SHA1:

67B54D4ED8066BF352F66317D74E770FAAA03B2F

SHA256:

7CF57766C8E838400B1286D0964B5886368DB9C1E32CDA8FD1224C1A9E185636

SSDEEP:

49152:ewE00hfSYUZVkupeYUg7S5fU3pKh8A/7PvLVGVNGHHMwaRsU9xBcsEGVSXbbApG6:M0aAkAUf5fypKh8ADPvoNGHswa79YKVB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MoE Chemistry Setup.exe (PID: 3428)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • 7za.exe (PID: 3900)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Drops 7-zip archiver for unpacking

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads settings of System Certificates

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads security settings of Internet Explorer

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Checks Windows Trust Settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads the Internet Settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • The process drops C-runtime libraries

      • 7za.exe (PID: 3900)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 3900)

  • INFO

    • Checks supported languages

      • MoE Chemistry Setup.exe (PID: 3428)
      • wmpnscfg.exe (PID: 3212)
      • MoE Chemistry Setup.tmp (PID: 3432)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • wmpnscfg.exe (PID: 3836)
      • 7za.exe (PID: 3900)
      • CrocodileChemistry.exe (PID: 3620)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3212)
      • MoE Chemistry Setup.tmp (PID: 3432)
      • wmpnscfg.exe (PID: 3836)
      • 7za.exe (PID: 3900)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • CrocodileChemistry.exe (PID: 3620)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3212)
      • wmpnscfg.exe (PID: 3836)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • CrocodileChemistry.exe (PID: 3620)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3212)
      • wmpnscfg.exe (PID: 3836)
      • CrocodileChemistry.exe (PID: 3620)

    • Create files in a temporary directory

      • MoE Chemistry Setup.exe (PID: 3428)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)

    • Creates files or folders in the user directory

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Checks proxy server information

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Creates files in the program directory

      • 7za.exe (PID: 3900)
      • MoE Chemistry Setup.tmp (PID: 3424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 15:27:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 54272
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: وزارة التعليم - المملكة العربية السعودية
FileDescription: المختبرات الافتراضية مادة الكيمياء Setup
FileVersion: 1.0.0
LegalCopyright: Copyright (c) 2019 وزارة التعليم - المملكة العربية السعودية
ProductName: المختبرات الافتراضية مادة الكيمياء
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start moe chemistry setup.exe no specs wmpnscfg.exe no specs moe chemistry setup.tmp no specs moe chemistry setup.exe moe chemistry setup.tmp wmpnscfg.exe no specs 7za.exe no specs crocodilechemistry.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3424"C:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmp" /SL5="$90184,652986,121856,C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" /SPAWNWND=$501FC /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmp
MoE Chemistry Setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-rhdac.tmp\moe chemistry setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3428"C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe—explorer.exe
User:
admin
Company:
وزارة التعليم - المملكة العربية السعودية
Integrity Level:
MEDIUM
Description:
المختبرات الافتراضية مادة الكيمياء Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\moe chemistry setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3432"C:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmp" /SL5="$60134,652986,121856,C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" C:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmp—MoE Chemistry Setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g0et5.tmp\moe chemistry setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3576"C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" /SPAWNWND=$501FC /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe
MoE Chemistry Setup.tmp
User:
admin
Company:
وزارة التعليم - المملكة العربية السعودية
Integrity Level:
HIGH
Description:
المختبرات الافتراضية مادة الكيمياء Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\moe chemistry setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3620"C:\Program Files\المختبرات الافتراضية مادة الكيمياء\CrocodileChemistry.exe" C:\Program Files\المختبرات الافتراضية مادة الكيمياء\CrocodileChemistry.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\المختبرات الافتراضية مادة الكيمياء\crocodilechemistry.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\المختبرات الافتراضية مادة الكيمياء\qt-mt336.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3836"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3900"C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\7za.exe" x -y -o"C:\Program Files\المختبرات الافتراضية مادة الكيمياء" -x!unins000.* "C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\MoE_Chemistry_Setup.tmp"C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\7za.exe—MoE Chemistry Setup.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
16.04
Modules
Images
c:\users\admin\appdata\local\temp\is-vs6fm.tmp\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
5 679
Read events
5 643
Write events
24
Delete events
12

Modification events

(PID) Process:(3212) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8BA85B40-4BFB-4832-905D-EDEDBE311F21}\{CE7EA37A-9F07-4BA5-B70F-0CF391F5C737}
Operation:delete keyName:(default)
Value:
(PID) Process:(3212) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8BA85B40-4BFB-4832-905D-EDEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3212) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{84898FAF-7BBC-4CA6-9771-9DECC7061280}
Operation:delete keyName:(default)
Value:
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
19
Suspicious files
37
Text files
1 902
Unknown types
0

Dropped files

PID
Process
Filename
Type
3428MoE Chemistry Setup.exeC:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmpexecutable
MD5:E8153D0EAB7853B4E45AB0633C75687B
SHA256:0E8F0CF05C4DFC11F932B6F4D6B89210A21D8FD103C7DB82505B00054DEB3ACE
3576MoE Chemistry Setup.exeC:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmpexecutable
MD5:E8153D0EAB7853B4E45AB0633C75687B
SHA256:0E8F0CF05C4DFC11F932B6F4D6B89210A21D8FD103C7DB82505B00054DEB3ACE
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\CSplash.bmpimage
MD5:3BE94F69D01AD341435FFC8AC18CAC7A
SHA256:209CBDD67353CD417C08DDFC45C046A1B146D8620097815E1BD97F60C387B374
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1174955AA6EA53F5FBC6CCD012E35790
SHA256:A76EB0E6E08C17D2A5BB1E7FD600C83EC0FDF88D75700108FE721D062B3F2EDC
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CRQQ2MTW.txttext
MD5:8AFE62798AF4FA26D51563789080FBF0
SHA256:8244034130EF9C9A4BFF8C1AD5EE905D9D00FFF2BB586174A94D8B6816975747
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:2D2A4FCA9FDD239B71CA447AEFE3E9F0
SHA256:DCC8312FE5523DF06D6CE04BE5540056B5763BF5F81E0297A660A0F9FC402FBB
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\idp.dllexecutable
MD5:55C310C0319260D798757557AB3BF636
SHA256:54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
39007za.exeC:\Program Files\المختبرات الافتراضية مادة الكيمياء\autorun.infbinary
MD5:42EDF2DBF8F59F4183E7E2F4563060C5
SHA256:A632C37D3E3B7A54F457D8D11AF0AE843A788AF275BC57E6A2E845D9A7D8DFE0
39007za.exeC:\Program Files\المختبرات الافتراضية مادة الكيمياء\chemistry.domain\parts\chemistry.xmltext
MD5:65E0201F2AFB66E44EED9F5282978F75
SHA256:3A621F768F758595E29465FBB52839C10785B1DA2E04793B2DEE25FDF78FDEA4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
8
DNS requests
4
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
MoE Chemistry Setup.tmp
HEAD
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
—
—
unknown
3424
MoE Chemistry Setup.tmp
HEAD
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
—
—
unknown
3424
MoE Chemistry Setup.tmp
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?360d3c682df81f63
unknown
compressed
4.66 Kb
unknown
3424
MoE Chemistry Setup.tmp
GET
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
html
167 b
unknown
3424
MoE Chemistry Setup.tmp
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAv4pCY7dOqroY%2Fobakg4w8%3D
unknown
binary
471 b
unknown
3424
MoE Chemistry Setup.tmp
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3424
MoE Chemistry Setup.tmp
67.199.248.11:80
bit.ly
GOOGLE-CLOUD-PLATFORM
US
shared
3424
MoE Chemistry Setup.tmp
162.125.66.15:443
dl.dropboxusercontent.com
DROPBOX
DE
malicious
3424
MoE Chemistry Setup.tmp
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3424
MoE Chemistry Setup.tmp
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.11
  • 67.199.248.10
shared
dl.dropboxusercontent.com
  • 162.125.66.15
shared
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
3424
MoE Chemistry Setup.tmp
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3424
MoE Chemistry Setup.tmp
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MoE Chemistry Setup.exe