| File name: | QS12Setup.exe |
| Full analysis: | https://app.any.run/tasks/c8c964fe-5058-4e4c-a766-4e8fd56f300d |
| Verdict: | Malicious activity |
| Analysis date: | December 13, 2023, 16:25:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 8D4FF9EA577DDF46375F37AF6D5D9010 |
| SHA1: | C7026A861C420D4DED3CC7EDAA8023297A46B8FD |
| SHA256: | FBD4F32BDE2075DC2AEC82C7286A688BDCA2118AABA31784E569B7334900B8E2 |
| SSDEEP: | 98304:IWZ0g6d+wcLnMZi25WmQyILpDGAw52ZbZRJadJepdyrMOr0qA3DX8bO:TiM |
MALICIOUS
Drops the executable file immediately after the start
- QS12Setup.exe (PID: 3064)
- QS12Setup.exe (PID: 2292)
- QS12Setup.tmp (PID: 1036)
Creates a writable file in the system directory
- QS12Setup.tmp (PID: 1036)
Registers / Runs the DLL via REGSVR32.EXE
- QS12Setup.tmp (PID: 1036)
SUSPICIOUS
Process drops legitimate windows executable
- QS12Setup.tmp (PID: 1036)
Reads the Windows owner or organization settings
- QS12Setup.tmp (PID: 1036)
Creates/Modifies COM task schedule object
- regsvr32.exe (PID: 3892)
Reads the Internet Settings
- quickstego.exe (PID: 2444)
INFO
Checks supported languages
- QS12Setup.exe (PID: 3064)
- QS12Setup.tmp (PID: 2540)
- QS12Setup.exe (PID: 2292)
- QS12Setup.tmp (PID: 1036)
- quickstego.exe (PID: 2444)
- quickstego.exe (PID: 3528)
Create files in a temporary directory
- QS12Setup.exe (PID: 3064)
- QS12Setup.exe (PID: 2292)
- QS12Setup.tmp (PID: 1036)
- quickstego.exe (PID: 2444)
- quickstego.exe (PID: 3528)
Reads the computer name
- QS12Setup.tmp (PID: 2540)
- QS12Setup.tmp (PID: 1036)
- quickstego.exe (PID: 2444)
- quickstego.exe (PID: 3528)
Creates files in the program directory
- QS12Setup.tmp (PID: 1036)
Creates files or folders in the user directory
- QS12Setup.tmp (PID: 1036)
- quickstego.exe (PID: 2444)
Reads mouse settings
- regsvr32.exe (PID: 3892)
Manual execution by a user
- quickstego.exe (PID: 2444)
- quickstego.exe (PID: 3528)
Reads the machine GUID from the registry
- quickstego.exe (PID: 2444)
- quickstego.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (77.7) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (10) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.6) |
| .exe | | | Win32 Executable (generic) (3.1) |
| .exe | | | Win16/32 Executable Delphi generic (1.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:20 00:22:17+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 37376 |
| InitializedDataSize: | 37376 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9a58 |
| OSVersion: | 1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.2.1.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | quickcrypto.com |
| FileDescription: | Quick Stego Setup |
| FileVersion: | 1.2a |
| LegalCopyright: | cybernescence ltd |
| ProductName: | Quick Stego |
| ProductVersion: | 1.2.1 |
Total processes
47
Monitored processes
8
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1036 | "C:\Users\admin\AppData\Local\Temp\is-I47MT.tmp\QS12Setup.tmp" /SL5="$1B0194,1550728,75776,C:\Users\admin\AppData\Local\Temp\QS12Setup.exe" /SPAWNWND=$120176 /NOTIFYWND=$1B0142 | C:\Users\admin\AppData\Local\Temp\is-I47MT.tmp\QS12Setup.tmp | — | QS12Setup.exe | |||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.49.0.0 Modules
| |||||||||||||||
| 1360 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\COMDLG32.ocx" | C:\Windows\System32\regsvr32.exe | — | QS12Setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2292 | "C:\Users\admin\AppData\Local\Temp\QS12Setup.exe" /SPAWNWND=$120176 /NOTIFYWND=$1B0142 | C:\Users\admin\AppData\Local\Temp\QS12Setup.exe | QS12Setup.tmp | ||||||||||||
User: admin Company: quickcrypto.com Integrity Level: HIGH Description: Quick Stego Setup Exit code: 0 Version: 1.2a Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Quick Stego\quickstego.exe" | C:\Program Files\Quick Stego\quickstego.exe | — | explorer.exe | |||||||||||
User: admin Company: Cybernescence.com Integrity Level: MEDIUM Exit code: 0 Version: 1.02.0001 Modules
| |||||||||||||||
| 2540 | "C:\Users\admin\AppData\Local\Temp\is-PIB0M.tmp\QS12Setup.tmp" /SL5="$1B0142,1550728,75776,C:\Users\admin\AppData\Local\Temp\QS12Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-PIB0M.tmp\QS12Setup.tmp | — | QS12Setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.49.0.0 Modules
| |||||||||||||||
| 3064 | "C:\Users\admin\AppData\Local\Temp\QS12Setup.exe" | C:\Users\admin\AppData\Local\Temp\QS12Setup.exe | — | explorer.exe | |||||||||||
User: admin Company: quickcrypto.com Integrity Level: MEDIUM Description: Quick Stego Setup Exit code: 0 Version: 1.2a Modules
| |||||||||||||||
| 3528 | "C:\Program Files\Quick Stego\quickstego.exe" | C:\Program Files\Quick Stego\quickstego.exe | — | explorer.exe | |||||||||||
User: admin Company: Cybernescence.com Integrity Level: MEDIUM Exit code: 0 Version: 1.02.0001 Modules
| |||||||||||||||
| 3892 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\mscomctl.ocx" | C:\Windows\System32\regsvr32.exe | — | QS12Setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
4 797
Read events
4 600
Write events
127
Delete events
70
Modification events
| (PID) Process: | (1036) QS12Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs |
| Operation: | write | Name: | C:\Windows\system32\mscomctl.ocx |
Value: 1 | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{996BF5E0-8044-4650-ADEB-0B013914E99C}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3892) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
Executable files
10
Suspicious files
5
Text files
7
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3064 | QS12Setup.exe | C:\Users\admin\AppData\Local\Temp\is-PIB0M.tmp\QS12Setup.tmp | executable | |
MD5:3BE8F3E4E6867E23C3189A32BEE0BBCC | SHA256:77E6C9832C5385B8A7EC8F278AEF75DF829020BC599F8484384813E297E2EB16 | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\is-54STH.tmp | executable | |
MD5:7EB79EB3AA505A778990C72AB61E1355 | SHA256:5E2F7C7843919C996483D501E3341E71B4713189A535AE78200ECB75760A95EB | |||
| 1036 | QS12Setup.tmp | C:\Windows\System32\COMDLG32.ocx | executable | |
MD5:6785B09FC2D286F88944718ACEE94B52 | SHA256:9AC63DCF5A2437ED43CB143479EC4A810915017D8EB138A7FEDE88867E2A8121 | |||
| 1036 | QS12Setup.tmp | C:\Windows\system32\is-HJEKS.tmp | executable | |
MD5:6785B09FC2D286F88944718ACEE94B52 | SHA256:9AC63DCF5A2437ED43CB143479EC4A810915017D8EB138A7FEDE88867E2A8121 | |||
| 1036 | QS12Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-GGNUH.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\is-3HBMS.tmp | executable | |
MD5:0C5811BE5D362761F27D3047D2CF2C40 | SHA256:96A0C4378A6C6D9FFEA9D8B20ED5A7A06FAE995151DC38935CFD90AE1D017D3F | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\quickstego_license.txt | text | |
MD5:2DC3157F239FD6F0B961DA019CD93B0F | SHA256:8900508E51F38A3A8F26D7BFD726F07B40A40F96AA2C1C9BD144EC4C10D618BE | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\unins000.exe | executable | |
MD5:7EB79EB3AA505A778990C72AB61E1355 | SHA256:5E2F7C7843919C996483D501E3341E71B4713189A535AE78200ECB75760A95EB | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\quickstego.exe | executable | |
MD5:0C5811BE5D362761F27D3047D2CF2C40 | SHA256:96A0C4378A6C6D9FFEA9D8B20ED5A7A06FAE995151DC38935CFD90AE1D017D3F | |||
| 1036 | QS12Setup.tmp | C:\Program Files\Quick Stego\unins000.dat | binary | |
MD5:7E629632384B329FA402DF9B1AF85CE4 | SHA256:9520E53E9FD88EE0E83C2AF883A3B38DF8F2E979A240D697FE292B10754BDA7E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |