File name: | SCU5Setup.exe |
Full analysis: | https://app.any.run/tasks/2595f9a2-2b90-40d3-a8d4-65e9cf0f6524 |
Verdict: | Malicious activity |
Analysis date: | September 19, 2019, 01:50:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 95ACBF43A61D21E90EDAB20EF37A4A72 |
SHA1: | 2DF31D6B9AA3C079E6818D0D6148E5C7FC3BA4C1 |
SHA256: | 95E13FDC24506E9F45D057C2AE7ED69DB60BDF56455E40ABB50C5E1199739CDC |
SSDEEP: | 196608:xMhYply8HDnjE5RI7J6SpgldeNlG600t40Les7B5L0TaH37VRdKw:xTygDjkRY6Spgwld/rgTxw |
.exe | | | Win32 Executable (generic) (3.6) |
---|---|---|
.exe | | | Generic Win/DOS Executable (1.6) |
.exe | | | DOS Executable Generic (1.5) |
ISInternalDescription: | Setup Suite Launcher Unicode |
---|---|
ISInternalVersion: | 24.0.464 |
InternalBuildNumber: | 182945 |
ProductVersion: | 5.0.3.226 |
ProductName: | System Checkup |
OriginalFileName: | InstallShield SetupSuite.exe |
LegalCopyright: | Copyright (c) 2018 iolo Technologies, LLC |
InternalName: | SetupSuite |
FileVersion: | 5.0.3.226 |
FileDescription: | System Checkup Installer |
CompanyName: | iolo technologies, LLC |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 5.0.3.226 |
FileVersionNumber: | 5.0.3.226 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x9bb19 |
UninitializedDataSize: | - |
InitializedDataSize: | 673280 |
CodeSize: | 861184 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2018:05:14 22:03:07+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 14-May-2018 20:03:07 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Flexera |
FileDescription: | Setup Suite Launcher Unicode |
FileVersion: | 24.0.464 |
InternalName: | SetupSuite |
LegalCopyright: | Copyright (c) 2018 Flexera. All Rights Reserved. |
OriginalFilename: | InstallShield SetupSuite.exe |
ProductName: | InstallShield |
ProductVersion: | 24.0 |
Internal Build Number: | 182945 |
ISInternalVersion: | 24.0.464 |
ISInternalDescription: | Setup Suite Launcher Unicode |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000130 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 8 |
Time date stamp: | 14-May-2018 20:03:07 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000D2031 | 0x000D2200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.40821 |
.orpc | 0x000D4000 | 0x000001A2 | 0x00000200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 4.75465 |
.rdata | 0x000D5000 | 0x00049B5C | 0x00049C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.47449 |
.data | 0x0011F000 | 0x00006734 | 0x00005A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.7607 |
.gfids | 0x00126000 | 0x00000134 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.46666 |
.tls | 0x00127000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x00128000 | 0x00043DE4 | 0x00043E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.7881 |
.reloc | 0x0016C000 | 0x00010C98 | 0x00010E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.56176 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.07176 | 640 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 3.31163 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 2.94006 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 6.80407 | 2216 | Latin 1 / Western European | UNKNOWN | RT_ICON |
5 | 6.12892 | 1384 | Latin 1 / Western European | UNKNOWN | RT_ICON |
6 | 7.97727 | 73611 | Latin 1 / Western European | UNKNOWN | RT_ICON |
7 | 1.94502 | 72 | Latin 1 / Western European | English - United States | RT_STRING |
8 | 6.20034 | 38056 | Latin 1 / Western European | UNKNOWN | RT_ICON |
9 | 6.22422 | 16936 | Latin 1 / Western European | UNKNOWN | RT_ICON |
10 | 6.2354 | 9640 | Latin 1 / Western European | UNKNOWN | RT_ICON |
ADVAPI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
RPCRT4.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
msi.dll (delay-loaded) |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3468 | "C:\Users\admin\AppData\Local\Temp\SCU5Setup.exe" | C:\Users\admin\AppData\Local\Temp\SCU5Setup.exe | — | explorer.exe |
User: admin Company: iolo technologies, LLC Integrity Level: MEDIUM Description: System Checkup Installer Exit code: 3221226540 Version: 5.0.3.226 | ||||
2900 | "C:\Users\admin\AppData\Local\Temp\SCU5Setup.exe" | C:\Users\admin\AppData\Local\Temp\SCU5Setup.exe | explorer.exe | |
User: admin Company: iolo technologies, LLC Integrity Level: HIGH Description: System Checkup Installer Version: 5.0.3.226 | ||||
3628 | "C:\Users\admin\AppData\Local\Temp\{83F2464F-CB71-4A4D-8B2B-3C370BBD9E91}\_isB451.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\admin\AppData\Local\Temp" ORIGINALSETUPEXENAME="SCU5Setup.exe" | C:\Users\admin\AppData\Local\Temp\{83F2464F-CB71-4A4D-8B2B-3C370BBD9E91}\_isB451.exe | SCU5Setup.exe | |
User: admin Company: iolo technologies, LLC Integrity Level: HIGH Description: System Checkup Installer Version: 5.0.3.226 | ||||
3372 | "C:\Users\admin\AppData\Local\Temp\{83F2464F-CB71-4A4D-8B2B-3C370BBD9E91}\_isB451.exe" -embedded:B9227067-8786-4D8F-9834-7A809DC67849 -IS_temp | C:\Users\admin\AppData\Local\Temp\{83F2464F-CB71-4A4D-8B2B-3C370BBD9E91}\_isB451.exe | — | _isB451.exe |
User: admin Company: iolo technologies, LLC Integrity Level: HIGH Description: System Checkup Installer Version: 5.0.3.226 | ||||
2784 | System32\taskkill.exe /F /IM SCU.exe | C:\Windows\System32\taskkill.exe | — | _isB451.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3152 | "C:\Users\admin\AppData\Local\Downloaded Installations\{495D186A-FDE4-4F54-B701-BD2E7C5CBF3C}\SCU5-Installer.exe" -s -f1".\SystemCheckup_install.iss" SUITE=True LANG=en | C:\Users\admin\AppData\Local\Downloaded Installations\{495D186A-FDE4-4F54-B701-BD2E7C5CBF3C}\SCU5-Installer.exe | _isB451.exe | |
User: admin Company: iolo technologies, LLC Integrity Level: HIGH Description: InstallScript Setup Launcher Unicode Exit code: 0 Version: 5.0.3.226 | ||||
3824 | C:\Users\admin\AppData\Local\Temp\{959BEA3D-1D31-43A8-9ACD-42AE064C3319}\SCU5-Installer.exe -s -f1".\SystemCheckup_install.iss" SUITE=True LANG=en -package:"C:\Users\admin\AppData\Local\Downloaded Installations\{495D186A-FDE4-4F54-B701-BD2E7C5CBF3C}\SCU5-Installer.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\admin\AppData\Local\Temp\{959BEA3D-1D31-43A8-9ACD-42AE064C3319}\Disk1\" -tempdisk1folder:"C:\Users\admin\AppData\Local\Temp\{959BEA3D-1D31-43A8-9ACD-42AE064C3319}\" -IS_OriginalLauncher:"C:\Users\admin\AppData\Local\Temp\{959BEA3D-1D31-43A8-9ACD-42AE064C3319}\Disk1\SCU5-Installer.exe" | C:\Users\admin\AppData\Local\Temp\{959BEA3D-1D31-43A8-9ACD-42AE064C3319}\SCU5-Installer.exe | SCU5-Installer.exe | |
User: admin Company: iolo technologies, LLC Integrity Level: HIGH Description: InstallScript Setup Launcher Unicode Exit code: 0 Version: 5.0.3.226 | ||||
2608 | C:\Windows\System32\schtasks.exe /delete /tn "iolo System Checkup SetTask" /f | C:\Windows\System32\schtasks.exe | — | SCU5-Installer.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3716 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3652 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000002D4" "000003A4" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2900 | SCU5Setup.exe | C:\Users\admin\AppData\Local\Temp\{83F2464F-CB71-4A4D-8B2B-3C370BBD9E91}\_isB451.exe | executable | |
MD5:95ACBF43A61D21E90EDAB20EF37A4A72 | SHA256:95E13FDC24506E9F45D057C2AE7ED69DB60BDF56455E40ABB50C5E1199739CDC | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\setup.xml | xml | |
MD5:3288D1EDE45BFF2A6A968BCFC42D91F0 | SHA256:865BCC92DCFC89A1AC445791270D474C2CD4B577127B180A087FF1D4091EB0D7 | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\Setup_UI.dll | executable | |
MD5:D1957AF54302D671227D44457002801C | SHA256:80AB2397B510A37002745000BD2F462513561608128E90A336451227E71C0FD3 | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\1033\ioloEULA.rtf | text | |
MD5:0DEF0DD0E4990270D1A502FA6956BDF4 | SHA256:93AAA1FA7E0A81FAB797105F81C16E8FCB05A6A80EFB948A927A08E743C7936C | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-200\ISLogoSmall.png | image | |
MD5:B948E2717C6283CA2339EAEF8102837F | SHA256:52C335337012024AE9742DD044FE673C3E26E2D2C83B0995E4BFC44884758650 | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-150\Remove.png | image | |
MD5:3935F5F99E5930A26FF9C78E7004EF1E | SHA256:759A320B1B41F49D95333AE9636AB772C64DDE712208BBAE1850D134F870A70E | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-150\Custom.png | image | |
MD5:41404BDC8ACC738078A96E03836A7017 | SHA256:2760DC6DA4DA352973B99D8209E54DC68C679D8C2800408F6D9481E03D9D3D9B | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-200\Custom.png | image | |
MD5:CA50DE91FD398EEA3960EEA2D5DFAF48 | SHA256:6274061D9A16D293D32E1EFEDEB149E6EB17370ACD9F5D597CE9E5EB746F4881 | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-200\Typical.png | image | |
MD5:A8EA2F7480FDA95BAB21A0E86386C551 | SHA256:57EE9024DD4BF02492C9750960D258AA7AA8DF94D528D266D8B5A18C3640B363 | |||
3628 | _isB451.exe | C:\Users\admin\AppData\Local\Temp\{B67FD018-00CE-4920-BA22-D5ADECD02485}\scale-150\Repair.png | image | |
MD5:C404CB5D0854361968716C3AB8630F92 | SHA256:ABDCECCB0963B6A2621BC1C1477C5D7FA0743E6656275FF1E3402464D7946C87 |
Process | Message |
---|---|
SCU5-Installer.exe | Getting existing security descriptor for 'MACHINE\Software\SCU' |
SCU5-Installer.exe | Failed to obtain existing security descriptor, last error: 0x00000002 |