File name:

setup.exe

Full analysis: https://app.any.run/tasks/9f164b8c-6e29-45f8-8874-4ccc9e27ce65
Verdict: Malicious activity
Analysis date: February 01, 2024, 17:05:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
MD5:

BC7DF98E1993DB13FBDC4EAD72295381

SHA1:

D6CDF733CAE488C6D97C48C46FAB9C901A170F00

SHA256:

F729B2B41C59FBBE89D62B1E654D10C97E32772E432594AF0AE52B062853C116

SSDEEP:

98304:TCeKV1dqumjdo9J6w8x+sVIRnuh/l1ZLQWcs0mQ8FpEDeoFYEoajPlvFRJr1rmlk:xn7nGsS70wT3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 4092)
      • _INS5176._MP (PID: 2032)

    • Creates a writable file in the system directory

      • _INS5176._MP (PID: 2032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 4092)
      • ntvdm.exe (PID: 2204)
      • _INS5176._MP (PID: 2032)

    • Starts application with an unusual extension

      • ntvdm.exe (PID: 2204)

    • Process drops legitimate windows executable

      • _INS5176._MP (PID: 2032)

    • Reads the Windows owner or organization settings

      • _INS5176._MP (PID: 2032)

  • INFO

    • Create files in a temporary directory

      • setup.exe (PID: 4092)
      • ntvdm.exe (PID: 2204)
      • _INS5176._MP (PID: 2032)

    • Checks supported languages

      • setup.exe (PID: 4092)
      • _INS5176._MP (PID: 2032)
      • 1stPage.exe (PID: 2768)

    • Drops the executable file immediately after the start

      • ntvdm.exe (PID: 2204)

    • Reads the computer name

      • _INS5176._MP (PID: 2032)
      • 1stPage.exe (PID: 2768)

    • Creates files in the program directory

      • _INS5176._MP (PID: 2032)

    • Manual execution by a user

      • 1stPage.exe (PID: 2768)

    • Reads the machine GUID from the registry

      • 1stPage.exe (PID: 2768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ 4.x (53)
.exe | InstallShield setup (16.9)
.exe | Win32 Executable MS Visual C++ (generic) (12.2)
.exe | Win64 Executable (generic) (10.8)
.dll | Win32 Dynamic Link Library (generic) (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1998:03:26 15:31:20+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5
CodeSize: 69120
InitializedDataSize: 75776
UninitializedDataSize: -
EntryPoint: 0xc110
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.1.5.0
ProductVersionNumber: 2.1.5.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: InstallShield Software Corporation
FileDescription: PackageForTheWeb Stub
FileVersion: 2.02.001
InternalName: STUB.EXE
LegalCopyright: Copyright © 1996 InstallShield Software Corporation
OriginalFileName: STUB32.EXE
ProductName: PackageForTheWeb Stub
ProductVersion: 2.02.001
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe ntvdm.exe _ins5176._mp 1stpage.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe—explorer.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
MEDIUM
Description:
PackageForTheWeb Stub
Exit code:
3221226540
Version:
2.02.001
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
2032C:\Users\admin\AppData\Local\Temp\_INS5176._MP C:\Users\admin\AppData\Local\Temp\_INS5176._MP
ntvdm.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
InstallShield Engine
Exit code:
0
Version:
5.10.145.0
Modules
Images
c:\users\admin\appdata\local\temp\_ins5176._mp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
2204"C:\Windows\system32\ntvdm.exe" -i1 -wsC:\Windows\System32\ntvdm.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2768"C:\Program Files\Evrsoft\1st Page 2000\1stPage.exe" C:\Program Files\Evrsoft\1st Page 2000\1stPage.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\evrsoft\1st page 2000\1stpage.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
4092"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
explorer.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
PackageForTheWeb Stub
Exit code:
0
Version:
2.02.001
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
822
Read events
822
Write events
0
Delete events
0

Modification events

No data
Executable files
27
Suspicious files
20
Text files
915
Unknown types
0

Dropped files

PID
Process
Filename
Type
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\pftw1.pkg —
MD5:—
SHA256:—
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\data1.cab —
MD5:—
SHA256:—
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\SETUP.EXEexecutable
MD5:AFE10D250B2C1850B37827C1D4E01EEF
SHA256:26ADEA53490125FD31E300DA97EF48B9DDC583753789051746B9A31406B418CF
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\SETUP.BMPimage
MD5:4A8D4DC0885AFEE94CE27FA3DF1F0CFE
SHA256:4C03646DA2C18AC70BD95A4E3C33DAAB1BEDEA10A03FAFF6CF92117B27A2EA78
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\_SETUP.DLLexecutable
MD5:8C6DC2367841533E1FE0C2E402CABD03
SHA256:2178D6BBB5A3CDB803341C516CB7B06019A2183E3F3572177F186802252209E5
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\setup.insbinary
MD5:6DB07FD6D02F852ABF510D889EF5DF44
SHA256:1F739CC7E8DAA6A3E3579CC5EC1522BDEB6BB13269B17858A3AADAFFC9CD0FE6
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\_INST32I.EX_binary
MD5:4251C8E7962CE3CA98FDCBE096C1D270
SHA256:065443568C396564EC51C72F54F81990C49E4B0CECE780ACBFC6A7494B65A3E0
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\_sys1.cabcompressed
MD5:AA384718B3DE6D9F312F8A260F86B155
SHA256:6EA5629A4C6E9FC7224D0B53CFFB5B9CE71618649F9E5AAA22ECC90735C5A038
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\_user1.cabcompressed
MD5:C28F5C5748B8B5862DAE3AD48FE7709F
SHA256:C0DF5C9D6A37BAC46A41ED3809CDD802EA25F67164EE64F90EEDBDD71A742EBA
4092setup.exeC:\Users\admin\AppData\Local\Temp\pft36D4~tmp\DATA.TAGtext
MD5:FE4D57D5392E7832ACA01C50DC7D15B3
SHA256:2EABC3BEEA122FF93533CC263CC90D10622214F585EADFFBAA3F88CC64DDFA6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe