analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SetupFile_605351.exe

Full analysis: https://app.any.run/tasks/e87a1388-9210-4f70-9b01-b48fc65de621
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 14, 2023, 17:48:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

B06029E68C041684751EED9E63DCF164

SHA1:

CBC52EE56366468D0DBCF43F4058F6FD7EA70167

SHA256:

7D4311B7CABA4881F54C5193B85EF22797896F30964CFC9DEB9721E12F84969C

SSDEEP:

98304:rLiQ0kaIGdTAfp+PXC9Yd5j4Wj2CnukaxljmUkkY2LLc1c4fQ3rkFz99xosiSUeW:gO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SetupFile_605351.exe (PID: 5056)
      • SPARKnApplication.exe (PID: 4452)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • SetupFile_605351.exe (PID: 4944)
      • SetupFile_605351.exe (PID: 5056)

    • Checks for Java to be installed

      • jusched.exe (PID: 5612)

    • Drops 7-zip archiver for unpacking

      • SetupFile_605351.exe (PID: 5056)
      • SPARKnApplication.exe (PID: 4452)

    • Application launched itself

      • SetupFile_605351.exe (PID: 4944)

  • INFO

    • Checks supported languages

      • SetupFile_605351.exe (PID: 4944)
      • SetupFile_605351.exe (PID: 5056)
      • SPARKnApplication.exe (PID: 4452)
      • jusched.exe (PID: 5612)

    • Reads the computer name

      • SetupFile_605351.exe (PID: 5056)
      • SPARKnApplication.exe (PID: 4452)
      • SetupFile_605351.exe (PID: 4944)

    • Process checks computer location settings

      • SetupFile_605351.exe (PID: 4944)
      • SetupFile_605351.exe (PID: 5056)

    • Manual execution by a user

      • jusched.exe (PID: 5612)

    • Creates files in the program directory

      • SPARKnApplication.exe (PID: 4452)
      • SetupFile_605351.exe (PID: 5056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (35.9)
.exe | Win32 Executable MS Visual C++ (generic) (27)
.exe | Win64 Executable (generic) (23.9)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.9)

EXIF

EXE

LegalTrademarks: -
FileVersion: 1.0.0.0
Comments: -
ProductVersion: 1.0.0.0
ProductName: SPARK Full
OriginalFileName: SPARKFull.exe
LegalCopyright: SPARK Full Applications Systems
InternalName: SPARKFull.exe
FileDescription: SPARK Full
CompanyName: SPARK Full Applications Systems
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 1
OSVersion: 4
EntryPoint: 0x2ed0
UninitializedDataSize: 48768
InitializedDataSize: 725412
CodeSize: 1437920
LinkerVersion: 3.22
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
TimeStamp: 0000:00:00 00:00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setupfile_605351.exe no specs setupfile_605351.exe sparknapplication.exe no specs jusched.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4944"C:\Users\admin\AppData\Local\Temp\SetupFile_605351.exe" C:\Users\admin\AppData\Local\Temp\SetupFile_605351.exe—explorer.exe
User:
admin
Company:
SPARK Full Applications Systems
Integrity Level:
MEDIUM
Description:
SPARK Full
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\setupfile_605351.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5056"C:\Users\admin\AppData\Local\Temp\SetupFile_605351.exe" -ux C:\Users\admin\AppData\Local\Temp\SetupFile_605351.exe
SetupFile_605351.exe
User:
admin
Company:
SPARK Full Applications Systems
Integrity Level:
HIGH
Description:
SPARK Full
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\setupfile_605351.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4452"C:\Program Files (x86)\SPARKFullpmbApplication\SPARKnApplication.exe" C:\Program Files (x86)\SPARKFullpmbApplication\SPARKnApplication.exe—SetupFile_605351.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Installer
Exit code:
0
Version:
22.01
Modules
Images
c:\program files (x86)\sparkfullpmbapplication\sparknapplication.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
5612"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe—runonce.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Update Scheduler
Exit code:
4294967292
Version:
2.8.271.9
Modules
Images
c:\program files (x86)\common files\java\java update\jusched.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
Total events
2 096
Read events
2 080
Write events
16
Delete events
0

Modification events

(PID) Process:(4944) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4944) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4944) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4944) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5056) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5056) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5056) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5056) SetupFile_605351.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
10
Suspicious files
3
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\ast.txttext
MD5:1F86AE235BC747A279C9E9EC72675CE4
SHA256:8FCD1B8CE6FED05F406C4B81AEA821132800BC494D3FD6F42A4258A81F8998EC
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\cy.txttext
MD5:0F5662A68805D859F871EDC07E766A57
SHA256:931DE741A6C8F1348A946623776FE36C55DD2FC384C7B1478225F7467853199E
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\an.txttext
MD5:BF8564B2DAD5D2506887F87AEE169A0A
SHA256:0E8DD119DFA6C6C1B3ACA993715092CDF1560947871092876D309DBC1940A14A
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\br.txttext
MD5:C2EB67D788756BE5ECAA0A8CFB3D1E0B
SHA256:0F6BF6749C42C844980DB32EE56CADC987CE245EF650BC7D626D56468A7CBE6A
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\de.txttext
MD5:40AE22F5BCBEAB6F622771562D584F2B
SHA256:06E5265A2B30807296480DC0B0D3A27E41F1381D61229E4EB239C4930D14A43E
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\az.txttext
MD5:81B732A8B4206FB747BFBFE524DDE192
SHA256:CAEC460E73BD0403C2BCDE7E773459BEA9112D1BFACBE413D4F21E51A5762BA6
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\da.txttext
MD5:D8ABA2DA47C1031832957B75A6524737
SHA256:F65026AE33D4302A7EF06A856F6F062C9730100F5A87D5C00FB3FEAF5FCD5805
4452SPARKnApplication.exeC:\Program Files\7-Zip\History.txttext
MD5:B1206A5ABF93BC64601A3CAA2DFF47D4
SHA256:24A8A7C00F0BB8AC3096F58F53BD47FA392B8D220C1C43D372100BD692C68E5F
4452SPARKnApplication.exeC:\Program Files\7-Zip\7-zip.chmbinary
MD5:34208890A28244903621CD32CC3FBDFC
SHA256:4B6939646570C9DDB5BFD39B8503EED99D8C64337E72F6DD4F9DDCFB4AC76703
4452SPARKnApplication.exeC:\Program Files\7-Zip\Lang\co.txttext
MD5:8E9EBA50A1FD7469D183A3CF4E806BB3
SHA256:0F485681C606F422F6EB7311A1F151873B47EED2832A129C2550B868E6610CD9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
25
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
104.126.37.161:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=cmd&setlang=en-US&cc=US&nohs=1&cp=3&cvid=3f163e973a5c46e0b3d2da5cd0a70b26&ig=89cb675ab51b4c528dbc890543b7474e
unknown
binary
4.83 Kb
—
—
—
GET
200
104.126.37.130:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=cm&setlang=en-US&cc=US&nohs=1&cp=2&cvid=3f163e973a5c46e0b3d2da5cd0a70b26&ig=49360abcd1e74bdebd75ad9f2ee27f01
unknown
binary
4.84 Kb
—
—
—
GET
200
104.126.37.139:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=c&setlang=en-US&cc=US&nohs=1&cp=1&cvid=3f163e973a5c46e0b3d2da5cd0a70b26&ig=d02479affad6402f80047fddc47ca6df
unknown
binary
5.01 Kb
—
—
—
GET
200
104.126.37.139:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=ser&setlang=en-US&cc=US&nohs=1&cp=3&cvid=3adf1539083a4f3182c619e908191b8f&ig=d88b400e577943a991a6fbec930746ab
unknown
binary
5.28 Kb
—
5056
SetupFile_605351.exe
GET
200
104.26.11.123:443
https://globalinstallationfile.com/2B7F57CABBD2FED3/35023998481/9A06381EE5EEA99B/70257618451?168D7405063864E81702576184
unknown
executable
1.50 Mb
—
—
—
GET
200
104.126.37.123:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=s&setlang=en-US&cc=US&nohs=1&cp=1&cvid=71734e6d8bbe44d7a072b155a2937084&ig=bb6b816550954a42a5de4a35d2b8b0df
unknown
binary
5.34 Kb
—
5008
SearchApp.exe
GET
200
104.126.37.168:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=s&setlang=en-US&cc=US&nohs=1&cp=1&cvid=3adf1539083a4f3182c619e908191b8f&ig=f1ea89a748964eb8be7b4026c9859c9c
unknown
binary
5.34 Kb
—
5008
SearchApp.exe
GET
200
104.126.37.185:443
https://www.bing.com/AS/API/WindowsCortanaPane/V2/Suggestions?qry=serv&setlang=en-US&cc=US&nohs=1&cp=4&cvid=3adf1539083a4f3182c619e908191b8f&ig=064d601885a0424795c7c9bf77ea4329
unknown
binary
5.00 Kb
—
—
—
GET
200
172.67.70.109:443
https://globalinstallationfile.com/326B289DDF75A04C/77813123281/2CE0AC27C1BFB201/70257613658?BE39FDA0CF1FE3F51702576136
unknown
text
32 b
—
5008
SearchApp.exe
POST
—
104.126.37.123:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3764
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4228
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5056
SetupFile_605351.exe
104.26.11.123:443
globalinstallationfile.com
CLOUDFLARENET
US
unknown
4228
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5008
SearchApp.exe
104.126.37.128:443
—
Akamai International B.V.
DE
unknown
2152
OfficeClickToRun.exe
20.189.173.8:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
239.255.255.250:3702
—
—
—
unknown
2120
svchost.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
globalinstallationfile.com
  • 104.26.11.123
  • 172.67.70.109
  • 104.26.10.123
unknown
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
self.events.data.microsoft.com
  • 20.189.173.8
  • 51.132.193.104
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
www.bing.com
  • 104.126.37.176
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.163
  • 104.126.37.185
  • 104.126.37.178
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupFile_605351.exe