�-P��D�y7٫��>�lL7vV��dOA�T���U�Θ�hwR�#��|����H(ůs����r�=�$��"� .}ZM����So�(Cd���@9Mr�;�k�_��������i�1�p�����haYl�XS��ݤ �kGs�����: Lǽ8<k=�����^ƻ.�]�A�ԯ/]xz�ٳ�LǓ��c�v�xa R-`n���nI�a�N�+��mu@�H:* ���)�6 �;?�Z���b;�?px�Wku��9�e %��Eq��\乊�gFܱ����t|��f$K���pO��j�S���L����5�Ne�[�y��� �6 ��v}��������K!X �:�V��Ź� (ƯjKJ� �M����A��0�]�nr�����qP�ټ >/RN//=h���Qj��f�����U(�~�E82|&1ڝ~����W.FGK<|�y�F(��%<DK���"�$�:qY{�B��ʞS)c��$<��Bb�8�M�@c�颺*FG�&*���q=�nO����MJ��dt��lט~�k[9��MPpy(=p�l�<�c����+�jB١!a�ǐ�FBA6��*��<���\��ڣ��JQҮ��}ِ�q{+�\�k��ֻ���>���tf�n���.$�,�T��?hع�Xr!:nֲ����G��x�:�(�j�Ԟ6^:[����R��G�9����r}E'iy�D��T�����t fD�\ek���3B[�i�ܫ�6�G/�C�S0��C��?�f�"p���pM�[�>�"���A����ia��b���������*HWnX���R�֓1�xH.C�B�}�j��|������ϐ�"�h! ����ž�~����a�> 2A��#ߢIF|�H��������Yv���>DSٮ�bϽ�����K]���ش"��we�5#���͘V�A*�� ���M�a� �-K!EW�����n*H��!�Ƽ^�M>������w��'k��]��h5�G����CpZ�����)��'�g��8P�����I�hM��\��������4����l���p-�����%1���*�z�s���Qu;c�n�����ܞvՔC "�|�v�ٳ�ß�d�'������?̎Bi�PW��t��^SX*�*�k?�hw˄=cE��R���jgx��.��z;�w8�E�T�a٨��a��;�983;����Oҙ0��� �`Bw!I�� {=P����s�fIqW��G��N\��1��\����������"r���,�w��1����9Iq;�ϭ\0�Z˓�0�+�7������w #圆AvyJ� �J�'�� �R9��� �%�y5v,cPˣnQ���j�wo_�#-�ת�� M!64�gn ���n��vzGŶ�]G���R�t�hP�,����:�$,��i �ʇ)��w�Z��B�����b��*�x�L}7]x@4MbF���n��:�Uo�G�b\�{�Zj ����1g�铏��w���g��D* a_�(W 1�v����7�8w7��C��J��ayE����*=���#_0ͱP��A�Ÿ��{��_bw� V��p�/U�W��G�u����]�[r�kB:�u�Q&���M�`��]�"���d��)�m�c�� #|,e�W��>J����'��T���=I�b��8�Go�_klH�G&1�#UJ �j�,&=��߱}w=���;�}e&�5��J!Q�N����Y��R�c�%!�6���6�e��S/O��n���R �5(jrk�]C�u���A�}���R}�[ع��c���܍�kV�����T� ��6�~F\��m������L���~!��q�G��֫(6bl������$��nB��S���+�����>�"�0���q]��B�,�/��P���"+G�m��ɒ�8�&��IX�̚P���S+��>��S^2��idG��UiH��s+[����<sZ{q?G��<�K=nr`'s���<{��R:D��R���bF(4K�0*��^ մ�hm�d��cM��Љ�����,�8�n��Rj������X�I��@�\���_c�{�xR_�̨)��:_:K�{���>KY^�u���H��D$[����z��N���� �g4Dj��5�:S'o�v���+�.������ԭ=Z�C4�jl`�H�;Q" �;��>���(# )MH�c�|�H�]ui#����y �ts�GƲJgԴz��Q�����~J��ZQo��j�9�z�����g���U���?��~*��(��������k�>v����|��2| -�f�RO����/�W�փآ�8���m�x <Ш+��^����q�������.�頭���߳RE����aЎ�g���:C�3����D:�sa%����_1*\5Ϻ��x��F+l��������[��P��h���#9�Ţ>�;�, ~ :5����|�z6&�c�[�w��4��x�����n8H�#�� ���L�F�������ˇ��V�[�,=H��XY����v�>W�r�i�0ۧ٭<_z�y��� �O�I <6Wt���rzx�f��u�2 �i�pN�z��؇8ULC�u��S�������eo����@Y�S�l����ֹ(=v���<Z��k(i-Ǥ5A��# ��1T��m����xM��s���OMD��D$������Ə D����s�S3�Vl�z�Ct&�T X���`D�y)�kqf��k'��˲H`���k�s�1�pB~C���kw���M�qtI�Z�̅��;� �axd5Zdiw�}�{noZ�K��QP�����kۇۍ�s)f�A�.�$m�hXb��:��7��!��d�TC��~�պ7��Gn�}�~�y��rx�ߚ���x��Z,���M ����Ĝ��-;1}����#��߆�����E�QǚDI,�V������e� ��ԋ����r>�� 3$ߣWҬ�y�W4Xr)iT���rQ����w�Ԫ%Sn��[��h#!��m�M,���q�LNwqڅ0k�9uq)c>��b_�'7�"Z[�PȨD�t
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20221111-en
General
-
Target
Setup.exe
-
Size
726.8MB
-
MD5
d65586901415c8485dd5dabb3e689840
-
SHA1
7e35d99c1b293aebab6126f8a761b051fafe48d9
-
SHA256
21d7ca5e7d331b90c2e010826770c8990f1fab404b6638060df58203ebbb8295
-
SHA512
41fdd2d0ee8482510d5d22bd102d7e5b8be11d298e5fdf563d7b67fd28fbfbf0f2442138ab5e7106e106423141253d90ed6d372ce6cbba0ec693e902d8a7ad9c
-
SSDEEP
196608:B8JkMi8jKWH1B6jiF4ttI4JAaZ+YS3w0BRK:aJkMi8jxHyjiFCI4JS3rRK
Malware Config
Signatures
Files
-
Setup.exe.exe windows x86
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Q#[ Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.>q3 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zuu Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 454KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ