Set-up[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Set-up.exe
Size 7.8MB
Sample260416-sjyncaft41
SHA256 4dad4bc88e4d2d50a03f4ba53bb6f8103cb74b152489300f533647e99263b4f2
MD5 d4034cc00860af52d78dcd7817dee7a5
SHA1 972f47b895ae6b9f1764b6f5b8dbd89a42a4ce96
SHA512 69d5d44663d3fc016ede359ac91e87e38e747d628f5f27c6289f5aa6cc986b69ac388db589e8627a398e60b8a66380899514c35c6a006d233a29f934ebd6bd5e
SSDEEP 98304:Fs5LohbYG+cNttOO23A1Q6PKU74G9IvJLAX68b0uCt9pSMpBdWY:zbnttO294G9IvJLgboxl
TLSH
T17D86095472D58064F1B32675AA7A6AA0467B7D219F3088CFB68C5D1D0B736D2E830F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Set-up.exe

.exe 7.8MB

Set-up.exe

IMPHASH 1db03ef829f2b875f24406e682d5a018
SHA256 4dad4bc88e4d2d50a03f4ba53bb6f8103cb74b152489300f533647e99263b4f2
MD5 d4034cc00860af52d78dcd7817dee7a5
SHA1 972f47b895ae6b9f1764b6f5b8dbd89a42a4ce96
SHA512 69d5d44663d3fc016ede359ac91e87e38e747d628f5f27c6289f5aa6cc986b69ac388db589e8627a398e60b8a66380899514c35c6a006d233a29f934ebd6bd5e
SSDEEP 98304:Fs5LohbYG+cNttOO23A1Q6PKU74G9IvJLAX68b0uCt9pSMpBdWY:zbnttO294G9IvJLgboxl
TLSH
T17D86095472D58064F1B32675AA7A6AA0467B7D219F3088CFB68C5D1D0B736D2E830F3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

7f:4a:49:2c:73:d3:5e:0a:ef:f0:bd:d2:c2:3a:98:7b:f6:14:52:e1:cf:3f:d4:49:08:36:b1:b7:e7:2f:94:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=AAM 256,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 2, 2021

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

05:35:93:bf:71:f7:48:1b:9f:b7:6b:cb:4e:cc:f5:78

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2020 - Dec 20, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

3236554

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\CI\CCHyperdrive\build\x64\main\ccd-hyperdrive\build\msvs_win32\Release\x86\sym\HDBootStrapper\HDBootStrapper\Set-up.pdb

kernel32

LCMapStringW GetCurrentProcessId GetUserDefaultLangID GetUserDefaultUILanguage OpenMutexW SetWaitableTimer CreateWaitableTimerW WaitForMultipleObjects CancelWaitableTimer CreateEventW SetEvent ResetEvent GetOverlappedResult ReadDirectoryChangesW GetFileSizeEx GetLocalTime GetTimeFormatW GetDateFormatW ExpandEnvironmentStringsW DeviceIoControl GetComputerNameExW FileTimeToSystemTime GetNativeSystemInfo GetWindowsDirectoryW InitializeCriticalSection GetLocaleInfoA EnumSystemLocalesW GetACP GetSystemDirectoryW ReleaseMutex CreateMutexW GetConsoleWindow FreeConsole AttachConsole GetStdHandle MulDiv GlobalUnlock GlobalLock GlobalAlloc GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree WideCharToMultiByte FreeLibrary LoadLibraryW Process32FirstW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP IsValidLocale WriteConsoleW ExitProcess ExitThread SetStdHandle SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList GetUserDefaultLCID Process32NextW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation MapViewOfFile CreateFileMappingW CreateFileA UnmapViewOfFile GetFullPathNameW Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess TerminateProcess GetExitCodeProcess GetModuleHandleW CreateProcessW GetProcAddress WaitForSingleObject GetCurrentProcess GetDriveTypeW lstrcmpW lstrcmpiW CopyFileW GetFileSize MoveFileExW LocalFree SetCurrentDirectoryW GetCurrentDirectoryW CloseHandle DeleteFileW GetDiskFreeSpaceExW GetLastError FormatMessageW GetThreadPriority SignalObjectAndWait CreateTimerQueue LoadLibraryExA FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW CompareStringW GetCPInfo EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetModuleHandleExW QueueUserWorkItem IsProcessorFeaturePresent GetExitCodeThread SwitchToThread WaitForSingleObjectEx GetStringTypeW SetThreadPriority ResumeThread SetFilePointerEx VirtualAlloc VirtualFree GetTimeZoneInformation ConnectNamedPipe CreateNamedPipeW SetNamedPipeHandleState QueryFullProcessImageNameW lstrcpyW GetVersionExW LoadLibraryA FindResourceExW TerminateThread ProcessIdToSessionId DuplicateHandle CreateThread VerifyVersionInfoW VerSetConditionMask GlobalFree FindResourceW LoadResource LockResource SizeofResource GetCurrentThread GetThreadTimes QueryPerformanceFrequency CreateSemaphoreW OpenSemaphoreW ReleaseSemaphore CreateDirectoryW TryEnterCriticalSection GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTimeAsFileTime LockFileEx CreateFileMappingA UnlockFile ReadFile HeapCompact GetSystemInfo DeleteFileA OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI FlushFileBuffers GetSystemTime SystemTimeToFileTime WriteFile GetFileAttributesExW SetDllDirectoryW SetFileAttributesW GetFileAttributesW CreateFileW LocalAlloc FindClose GetTempPathW GetModuleFileNameW RemoveDirectoryW lstrlenW FindNextFileW SetLastError FindFirstFileW VirtualProtect

user32

RegisterWindowMessageW GetParent GetClassInfoExW PostQuitMessage GetDlgItem GetClientRect SetWindowLongW SetCapture GetClassNameW LoadCursorW TranslateMessage TranslateAcceleratorW BringWindowToTop SetClassLongW AppendMenuW GetClassLongW AllowSetForegroundWindow GetShellWindow EnumWindows GetSystemMenu LoadIconW EnableMenuItem SystemParametersInfoW LoadImageW PostThreadMessageW wsprintfW CharNextW SetForegroundWindow CreateAcceleratorTableW MoveWindow GetForegroundWindow GetSysColor AttachThreadInput IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow SetWindowPos DispatchMessageW InvalidateRgn MessageBoxW SendMessageW IsWindow ShowWindow GetActiveWindow RegisterClassExW SetWindowTextW ScreenToClient GetDC GetWindowRect GetWindowTextW EndPaint BeginPaint IsIconic CreateWindowExW ReleaseCapture SetFocus FillRect DestroyWindow GetFocus GetWindow UnregisterClassW PostMessageW CallWindowProcW DefWindowProcW GetDesktopWindow GetMessageW ReleaseDC InvalidateRect GetWindowTextLengthW GetSystemMetrics GetAsyncKeyState GetWindowLongW GetWindowThreadProcessId

gdi32

CreateSolidBrush DeleteObject BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject DeleteDC GetObjectW GetDeviceCaps

advapi32

CryptAcquireContextW CryptHashData CryptDestroyHash CryptGetHashParam RevertToSelf ConvertStringSidToSidW ImpersonateLoggedOnUser ConvertSidToStringSidW DuplicateTokenEx EqualSid LookupAccountSidW CryptReleaseContext RegQueryValueExA RegDeleteKeyExW RegEnumValueW GetUserNameW CredWriteW CredReadW CredEnumerateW CredFree CredDeleteW RegCloseKey RegFlushKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges SetEntriesInAclW SetNamedSecurityInfoW GetNamedSecurityInfoW OpenProcessToken GetTokenInformation CreateWellKnownSid InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid SetSecurityDescriptorDacl CryptCreateHash

shell32

SHGetPathFromIDListW SHGetFolderLocation SHGetSpecialFolderPathW SHGetFolderPathW SHGetMalloc ord680 SHGetSpecialFolderLocation ShellExecuteExW CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath SHCreateDirectoryExW ord51 SHBrowseForFolderW

ole32

CLSIDFromString OleLockRunning OleInitialize CoUninitialize OleRun CoReleaseServerProcess CoAddRefServerProcess CoInitializeEx CoSetProxyBlanket CreateStreamOnHGlobal OleUninitialize CoTaskMemAlloc CoGetClassObject CoCreateInstance StringFromGUID2 CoCreateGuid CoInitialize CoTaskMemFree CLSIDFromProgID

oleaut32

SysAllocStringByteLen SysStringByteLen VariantCopy DispCallFunc GetErrorInfo SysFreeString LoadRegTypeLi VariantInit LoadTypeLi OleCreateFontIndirect SysAllocString VariantClear VariantChangeType SysStringLen SysAllocStringLen

iphlpapi

GetAdaptersAddresses

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpSendRequest WinHttpQueryOption WinHttpOpen WinHttpSetCredentials WinHttpSetTimeouts WinHttpQueryHeaders WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser WinHttpConnect WinHttpQueryDataAvailable WinHttpCrackUrl

wininet

InternetCanonicalizeUrlW

bcrypt

BCryptGenerateSymmetricKey BCryptSetProperty BCryptGetProperty BCryptVerifySignature BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyHash BCryptEncrypt BCryptDecrypt BCryptDestroyKey

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

credui

CredUnPackAuthenticationBufferW CredUIPromptForWindowsCredentialsW

shlwapi

PathFileExistsW PathFindFileNameW PathIsRelativeW PathIsUNCW PathStripPathW PathIsRootW PathAddBackslashW PathStripToRootW UrlIsW SHGetValueW PathIsSystemFolderW PathFileExistsA PathAppendW PathIsFileSpecW PathAddExtensionW PathRemoveExtensionW UrlEscapeW PathIsNetworkPathW PathIsDirectoryW PathRemoveFileSpecW PathRenameExtensionW PathRemoveBackslashW

crypt32

CryptProtectData CryptUnprotectData CryptStringToBinaryW CertOpenStore CertGetIssuerCertificateFromStore CertCloseStore CertAddCertificateContextToStore CertVerifySubjectCertificateContext CertGetNameStringW CertFindCertificateInStore CryptImportPublicKeyInfoEx2 CryptHashCertificate2 CertCreateCertificateContext CertFreeCertificateContext

ws2_32

WSAStartup WSACleanup getnameinfo

secur32

GetUserNameExW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain

msi

ord70 ord113

comctl32

InitCommonControlsEx

generic

count=23, id=259, version=26715,

count=2, id=199, version=41118,

count=19, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,

count=27, id=259, productName=VS2019 v16.2.3 build 27905, version=27905,

count=164, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,

count=225, id=261, version=26715,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=261, productName=VS2015 UPD2 build 23918, version=23918,

count=1, id=260, productName=VS2015 UPD1 build 23506, version=23506,

count=8, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=39, id=260, version=26715,

count=2, id=262, version=26715,

count=49, id=257, version=26715,

count=587, id=1, productName=Unmarked objects,

count=397, id=265, version=28106,

count=1, id=255, version=28106,

count=1, id=151,

count=1, id=258, version=28106,