File name:

101-setup-simba-validador-5-8-7.exe

Full analysis: https://app.any.run/tasks/21e7d9c2-cdad-4499-8146-36014bfcdc58
Verdict: Malicious activity
Analysis date: December 13, 2024, 19:08:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

A9E6590916C73315E72A2C940FBDFA20

SHA1:

64F3D93D1A9ABCB33B4A6BAD10C53182A6E6D28B

SHA256:

AD8557F2C215985593D45EDA45136B94106149E4F48A66FD8C94C0E62770A529

SSDEEP:

98304:5+QqZ8fEaQOjOpjcCzbx29wNZEbAlC0JtgsN62sWsA3Gd4pvX1RbEqlQ1R5TVatM:YpkxZ5fXMv65B87dM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 101-setup-simba-validador-5-8-7.exe (PID: 6716)
      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

    • Reads the Windows owner or organization settings

      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

  • INFO

    • Creates files or folders in the user directory

      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

    • Create files in a temporary directory

      • 101-setup-simba-validador-5-8-7.exe (PID: 6716)
      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

    • Reads the computer name

      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

    • Checks supported languages

      • 101-setup-simba-validador-5-8-7.exe (PID: 6716)
      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)

    • Creates a software uninstall entry

      • 101-setup-simba-validador-5-8-7.tmp (PID: 6736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

ProductVersion: 5.8.7
ProductName: SIMBA Validador
OriginalFileName:
LegalCopyright:
FileVersion:
FileDescription: SIMBA Validador Setup
CompanyName:
Comments: This installation was built with Inno Setup.
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: 6
OSVersion: 6.1
EntryPoint: 0xb5eec
UninitializedDataSize: -
InitializedDataSize: 89088
CodeSize: 741376
LinkerVersion: 2.25
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
TimeStamp: 2021:06:03 08:09:11+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
2
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 101-setup-simba-validador-5-8-7.exe 101-setup-simba-validador-5-8-7.tmp

Process information

PID
CMD
Path
Indicators
Parent process
6716"C:\Users\admin\AppData\Local\Temp\101-setup-simba-validador-5-8-7.exe" C:\Users\admin\AppData\Local\Temp\101-setup-simba-validador-5-8-7.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
SIMBA Validador Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\101-setup-simba-validador-5-8-7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6736"C:\Users\admin\AppData\Local\Temp\is-GG9SM.tmp\101-setup-simba-validador-5-8-7.tmp" /SL5="$80356,12822517,831488,C:\Users\admin\AppData\Local\Temp\101-setup-simba-validador-5-8-7.exe" C:\Users\admin\AppData\Local\Temp\is-GG9SM.tmp\101-setup-simba-validador-5-8-7.tmp
101-setup-simba-validador-5-8-7.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-gg9sm.tmp\101-setup-simba-validador-5-8-7.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
257
Read events
238
Write events
19
Delete events
0

Modification events

(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.0
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\Documents\Programas SIMBA\Validador
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\Documents\Programas SIMBA\Validador\
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Programas SIMBA\Validador
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:Inno Setup: Language
Value:
brazilianportuguese
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:DisplayName
Value:
SIMBA Validador versão 5.8.7
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\Documents\Programas SIMBA\Validador\unins000.exe
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\Documents\Programas SIMBA\Validador\unins000.exe"
(PID) Process:(6736) 101-setup-simba-validador-5-8-7.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SIMBA Validador_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\Documents\Programas SIMBA\Validador\unins000.exe" /SILENT
Executable files
22
Suspicious files
41
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\core-renderer-R8.jarjava
MD5:EA71DC9EE36542604AA1331538CFB368
SHA256:4A395A32473238279532D65A1282D06F401392882D465D04B56BC9F71512B541
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\commons-collections-3.2.1.jarcompressed
MD5:13BC641AFD7FD95E09B260F69C1E4C91
SHA256:87363A4C94EAABEEFD8B930CB059F66B64C9F7D632862F23DE3012DA7660047B
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\commons-lang-2.4.jarcompressed
MD5:237A8E845441BAD2E535C57D985C8204
SHA256:2C73B940C91250BC98346926270F13A6A10BB6E29D2C9316A70D134E382C873E
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\is-3AGL5.tmpexecutable
MD5:296136EF4C5AB66219AE101A9E8B7467
SHA256:7429375484B1B9FB2EEB2BCCACFE78193C7396021C6260875ED0C778F48C8238
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\unins000.exeexecutable
MD5:296136EF4C5AB66219AE101A9E8B7467
SHA256:7429375484B1B9FB2EEB2BCCACFE78193C7396021C6260875ED0C778F48C8238
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\commons-codec-1.9.jarcompressed
MD5:75615356605C8128013DA9E3AC62A249
SHA256:AD19D2601C3ABF0B946B5C3A4113E226A8C1E3305E395B90013B78DD94A723CE
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\simba-validador.exeexecutable
MD5:C80FCF8A46D8F23322708D61BB4A6143
SHA256:92CAD8B4D5B916A0871750449A7509E1A0F32867193E38B6E5D8E82619B3A455
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\commons-io-2.4.jarcompressed
MD5:7F97854DC04C119D461FED14F5D8BB96
SHA256:CC6A41DC3EAACC9E440A6BD0D2890B20D36B4EE408FE2D67122F328BB6E01581
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\lib\gson-2.8.6.jarcompressed
MD5:310F5841387183ACA7900FEAD98D4858
SHA256:C8FB4839054D280B3033F800D1F5A97DE2F028EB8BA2EB458AD287E536F3F25F
6736101-setup-simba-validador-5-8-7.tmpC:\Users\admin\Documents\Programas SIMBA\Validador\simba-validador.jarjava
MD5:E38A8F6A8CF839E4C4E85A92F80CE755
SHA256:5F2B2DCF2B9C35A17327265C00F2E80BF63DA5B70480121AF5570A9DEDF8A61B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
43
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
7084
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6320
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2380
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 142.250.186.78
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.140
  • 2.23.209.189
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
101-setup-simba-validador-5-8-7.exe