File name:

mysetup.exe

Full analysis: https://app.any.run/tasks/de5dd6ef-320e-46cb-891d-a1203aac7190
Verdict: Malicious activity
Analysis date: April 25, 2024, 13:15:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

54D8FF627DBD1FF4B59ACD19D43BCA29

SHA1:

0AF4C9D01E5EFA045E5F5E317408F58E5B4C440D

SHA256:

D58916B8B9B77784013075798E88AB7C344AE69CD9ABED0C430995D4187D0671

SSDEEP:

49152:u7HecD4dnbibBlK6bjsbmLApne0Fop4R2uXB3iyLT/ex4XrL7P42DpJXWZn80cwi:2+cD4dnYbIkWnXFopLQ3iUrex4vkY7ma

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • mysetup.exe (PID: 324)
      • mysetup.exe (PID: 2268)
      • mysetup.tmp (PID: 2740)

    • Changes powershell execution policy (Bypass)

      • mysetup.tmp (PID: 2740)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • mysetup.exe (PID: 324)
      • mysetup.exe (PID: 2268)
      • mysetup.tmp (PID: 2740)

    • Reads the Windows owner or organization settings

      • mysetup.tmp (PID: 2740)

    • Non-standard symbols in registry

      • mysetup.tmp (PID: 2740)
      • WINWORD.EXE (PID: 2336)

    • Starts POWERSHELL.EXE for commands execution

      • mysetup.tmp (PID: 2740)

  • INFO

    • Checks supported languages

      • mysetup.exe (PID: 324)
      • mysetup.tmp (PID: 1072)
      • mysetup.exe (PID: 2268)
      • mysetup.tmp (PID: 2740)

    • Create files in a temporary directory

      • mysetup.exe (PID: 324)
      • mysetup.exe (PID: 2268)

    • Reads the computer name

      • mysetup.tmp (PID: 1072)
      • mysetup.tmp (PID: 2740)

    • Creates files in the program directory

      • mysetup.tmp (PID: 2740)

    • Manual execution by a user

      • WINWORD.EXE (PID: 2336)

    • Creates a software uninstall entry

      • mysetup.tmp (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 89600
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EnableComputerRestore Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: EnableComputerRestore
ProductVersion: 1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start mysetup.exe mysetup.tmp no specs mysetup.exe mysetup.tmp powershell.exe no specs SPPSurrogate no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\AppData\Local\Temp\mysetup.exe" C:\Users\admin\AppData\Local\Temp\mysetup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
EnableComputerRestore Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\mysetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1072"C:\Users\admin\AppData\Local\Temp\is-8OLAR.tmp\mysetup.tmp" /SL5="$22016A,832512,832512,C:\Users\admin\AppData\Local\Temp\mysetup.exe" C:\Users\admin\AppData\Local\Temp\is-8OLAR.tmp\mysetup.tmp—mysetup.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8olar.tmp\mysetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2156C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2268"C:\Users\admin\AppData\Local\Temp\mysetup.exe" /SPAWNWND=$190140 /NOTIFYWND=$22016A C:\Users\admin\AppData\Local\Temp\mysetup.exe
mysetup.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
EnableComputerRestore Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\mysetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2336"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\roundpurposes.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2740"C:\Users\admin\AppData\Local\Temp\is-975PT.tmp\mysetup.tmp" /SL5="$1C0194,832512,832512,C:\Users\admin\AppData\Local\Temp\mysetup.exe" /SPAWNWND=$190140 /NOTIFYWND=$22016A C:\Users\admin\AppData\Local\Temp\is-975PT.tmp\mysetup.tmp
mysetup.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-975pt.tmp\mysetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3244"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Enable-ComputerRestore -Drive 'C:'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mysetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
12 441
Read events
11 491
Write events
630
Delete events
320

Modification events

(PID) Process:(2740) mysetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
B40A0000C8DED3A41297DA01
(PID) Process:(2740) mysetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
AB835AF3A75C8E41C06215D7A1BCE6C4E4DF8FDC4A5670D1F47494B5AEC31A8B
(PID) Process:(2740) mysetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.2
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\EnableComputerRestore
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\EnableComputerRestore\
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(2740) mysetup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EnableComputerRestore_is1
Operation:writeName:DisplayName
Value:
EnableComputerRestore version 1.0
Executable files
5
Suspicious files
8
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
2336WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR8506.tmp.cvr —
MD5:—
SHA256:—
2740mysetup.tmpC:\Program Files\EnableComputerRestore\unins000.datbinary
MD5:B46D4582DE876204142E2C8086C186B1
SHA256:13577AF87D7BE54E54CCD30A3F58B072E40A2D026DBEBCC675E27EAFCA2B299B
2740mysetup.tmpC:\Program Files\EnableComputerRestore\is-VO7OO.tmpexecutable
MD5:95D8E4D0F94A062F8AD4570E6BE4BD17
SHA256:56FCF6BF51870E9ED32A2BD6F018CE57F5DD277BDD1B35CBCCF0C4541A519B5C
2740mysetup.tmpC:\Program Files\EnableComputerRestore\unins000.exeexecutable
MD5:95D8E4D0F94A062F8AD4570E6BE4BD17
SHA256:56FCF6BF51870E9ED32A2BD6F018CE57F5DD277BDD1B35CBCCF0C4541A519B5C
2268mysetup.exeC:\Users\admin\AppData\Local\Temp\is-975PT.tmp\mysetup.tmpexecutable
MD5:AD8934B75793A3D9E62798825516276E
SHA256:0BD4C18DC4C86BA337D79D6990407C39B6BD4F7BFDA08737E8E681D2C37BC0C1
2336WINWORD.EXEC:\Users\admin\Desktop\~$undpurposes.rtfpgc
MD5:DFEC985F745CE8EC110207DF9DDBA380
SHA256:9EC0D0C6DB46803994FC80A61D47565B3E35F8C6B464AB8933345F20E8664B09
3244powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:42E3956892291F5EE35E1B989213EF05
SHA256:D4E6947871B5FD00AD32F8707479DD6EC92AB65D8C6D157B1C0C3D99D575E468
2336WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:F2F95E68F4C1DB94260C0E243206084C
SHA256:3EBA077D5E66932B57352D7346DCA3D5BD8B0697F01930AC0650AA66470C920B
2336WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:27F82105736D6AA3FF0042586635E9B2
SHA256:78FC6979D1B61E5CCFCC061AE1FD5EC18A35327FDFC3A99252BCB9CC5A3F1021
2336WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3A3CC17F-CD72-4875-8D7A-E0CE5E3A5E77}.tmpsmt
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mysetup.exe