setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 7.4MB
Sample260730-215mnayfre
SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
MD5 7488d696f9a3d74e093b4c31ef7282c6
SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
TLSH
T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

setup.exe

.exe 7.4MB

setup.exe

IMPHASH 9e71e4eb9e5e4331174aa2b57e2ff185
SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
MD5 7488d696f9a3d74e093b4c31ef7282c6
SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
TLSH
T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 11, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

ee:b6:e6:52:a8:5a:50:0d:49:73:e0:e8:19:a2:6c:24:f0:97:78:3b:3f:b8:b2:e1:db:5e:e5:1d:00:31:cb:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 11, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 19, 2023 - Oct 16, 2024

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f3:c5:0a:43:ae:03:cc:1d:31:00:01:00:00:01:f3

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 19, 2023 - Oct 16, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

Major OS version

Entry point

4159692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\omr\target\x86\ship\click2run\en-us\SetupODT.pdb

advapi32

ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext CreateWellKnownSid CheckTokenMembership RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegDeleteTreeW RegDeleteKeyW RegGetValueW RegDeleteValueW IsValidSid GetSidSubAuthorityCount GetSidSubAuthority EventWriteTransfer EventRegister EventUnregister EventSetInformation RegNotifyChangeKeyValue RevertToSelf OpenThreadToken GetLengthSid CopySid InitializeAcl AddAccessAllowedAce AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA EqualSid RegEnumValueA RegDeleteValueA RegGetValueA EventWrite LookupPrivilegeValueW AdjustTokenPrivileges OpenSCManagerW CloseServiceHandle OpenServiceW QueryServiceStatusEx QueryServiceConfigW StartServiceW ControlService EnumDependentServicesW ChangeServiceConfigW

ole32

CoInitialize CLSIDFromString CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree StringFromCLSID CoCreateInstance CoSetProxyBlanket CoCreateGuid StringFromGUID2 CoCreateFreeThreadedMarshaler IIDFromString CoInitializeSecurity CoInitializeEx CoEnableCallCancellation CoDisableCallCancellation CoCancelCall CoUninitialize

oleaut32

GetErrorInfo SysFreeString VariantInit VariantClear SetErrorInfo SysAllocString SysStringLen

gdi32

CreateFontW SetBkColor SetTextColor DeleteObject Rectangle SetDCPenColor CreatePen GetTextExtentPoint32W SelectObject CreateSolidBrush SetDCBrushColor GetTextMetricsW GetStockObject GetDeviceCaps

kernel32

RtlUnwind SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo EncodePointer CloseThreadpoolWork CreateTimerQueueTimer ExitProcess GetOEMCP CloseHandle GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryW SetLastError GetModuleFileNameW OutputDebugStringA CompareStringEx LocalFree HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary CreateThread GetCurrentThreadId GetExitCodeThread SetProcessMitigationPolicy CreateEventExW WriteFile DeleteFileW WideCharToMultiByte IsWow64Process GetModuleHandleExW ExpandEnvironmentStringsW GlobalFree MultiByteToWideChar InitializeCriticalSectionEx DeleteCriticalSection DecodePointer CreateMutexW GetNativeSystemInfo VerSetConditionMask VerifyVersionInfoW GetUserDefaultLocaleName FlsFree FlsAlloc AttachConsole AllocConsole GetStdHandle WriteConsoleW FreeConsole LocaleNameToLCID FindClose UnmapViewOfFile CreateFileA GetFileSize CreateFileMappingW MapViewOfFile Sleep GetStringTypeExW GetUserDefaultLCID LoadLibraryA LCMapStringW FormatMessageA RaiseException InitializeSRWLock AcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared OpenProcess GetExitCodeProcess GetProcessTimes GetTickCount64 GetSystemTimeAsFileTime TerminateProcess GetModuleFileNameA GetShortPathNameA K32GetModuleFileNameExW CreateProcessW LoadLibraryExW FindResourceW SizeofResource LoadResource GlobalMemoryStatusEx GetVersionExW IsValidCodePage GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetCPInfoExW GetDiskFreeSpaceExW CreateFileW DeviceIoControl SetErrorMode GetComputerNameW MulDiv FormatMessageW GetLogicalProcessorInformation GetSystemDirectoryW HeapAlloc CreateEventW SetEvent WaitForSingleObject EnumSystemLocalesW WaitForSingleObjectEx WaitForMultipleObjectsEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CloseThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CreateThreadpoolTimer CloseThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait CreateThreadpoolWork SubmitThreadpoolWork QueryDepthSList TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeSListHead InterlockedPushEntrySList InterlockedPopEntrySList RtlCaptureStackBackTrace TzSpecificLocalTimeToSystemTime QueryUnbiasedInterruptTime OpenEventW ReleaseMutex CreateMutexExW OpenMutexW GetTempPathW GetLongPathNameW GetFinalPathNameByHandleW TlsAlloc TlsFree FlsGetValue TlsGetValue FlsSetValue TlsSetValue ResetEvent IsDebuggerPresent GetFileAttributesExW FindFirstFileExW MoveFileExW FindNextFileW CreateDirectoryW SetFileAttributesW ReadFile SetFilePointerEx SetEndOfFile GetFileSizeEx FlushFileBuffers LockFileEx UnlockFileEx GetFileInformationByHandleEx GetCurrentDirectoryW GetTempFileNameW CopyFileExW GetVolumePathNamesForVolumeNameW SetFileInformationByHandle WaitForMultipleObjects K32EnumProcessModulesEx OpenThread GetFileType SetFilePointer GetOverlappedResult GetFileAttributesW GetFileTime CopyFileW QueryPerformanceCounter QueryPerformanceFrequency GlobalAlloc LockResource LCIDToLocaleName SetFileTime CancelIoEx GetProcessAffinityMask CreateWaitableTimerW SetWaitableTimerEx CancelWaitableTimer GetTickCount WerRegisterMemoryBlock WerUnregisterMemoryBlock QueryFullProcessImageNameW CreateIoCompletionPort PostQueuedCompletionStatus GetThreadIOPendingFlag GetCurrentThread GetQueuedCompletionStatus GetStartupInfoW CreateMemoryResourceNotification GetSystemPowerStatus IsSystemResumeAutomatic OutputDebugStringW OpenEventA CreateEventA OpenMutexA CreateMutexA OpenSemaphoreA CreateSemaphoreA OpenFileMappingA CreateFileMappingA LocalAlloc GetLocaleInfoEx LCMapStringEx IsValidLocale GetSystemDefaultLCID ResolveLocaleName EnumSystemLocalesEx GetSystemDefaultLocaleName GetFileAttributesA LoadLibraryExA GetUserGeoID GetLocaleInfoW GetUserPreferredUILanguages GetACP GetTimeZoneInformation AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW LockFile InitializeCriticalSection GetFullPathNameA HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA FlushViewOfFile DeleteFileA HeapReAlloc GetSystemInfo HeapCompact HeapDestroy UnlockFile K32GetProcessMemoryInfo GetPhysicallyInstalledSystemMemory GetProductInfo SwitchToThread InitializeCriticalSectionAndSpinCount FindFirstFileW GetThreadLocale lstrcmpW ProcessIdToSessionId GetCommandLineW SetEnvironmentVariableW GetPriorityClass K32EnumProcesses FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent InitOnceComplete InitOnceBeginInitialize CreateSymbolicLinkW DeleteTimerQueueTimer GetThreadTimes FreeLibraryAndExitThread ExitThread GetConsoleMode ReadConsoleW GetConsoleOutputCP RemoveDirectoryW GetFileInformationByHandle GetStringTypeW CompareStringW SetStdHandle GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect VirtualQuery GetLocalTime ReleaseSemaphore TryAcquireSRWLockExclusive GetSystemPreferredUILanguages K32GetProcessImageFileNameW GetDateFormatW GetTimeFormatW GetDriveTypeW

setupapi

SetupIterateCabinetW

gdiplus

GdipDeleteGraphics GdiplusStartup GdipCreateFromHDC GdipDrawImageRectI GdipLoadImageFromStream GdipAlloc GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromScan0 GdipDisposeImage GdipCloneImage GdipFree

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

advapi32

ole32

oleaut32

gdi32

kernel32

setupapi

gdiplus

generic