Analysis Report Setup.exe

Overview

General Information

Joe Sandbox Version:	25.0.0 Tiger's Eye
Analysis ID:	825331
Start date:	26.03.2019
Start time:	15:20:32
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 12m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Setup.exe
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 7 x64 (Office 2003 SP3, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.evad.winEXE@13/20@7/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 98.9% (good quality ratio 94.9%) Quality average: 82.1% Quality standard deviation: 25.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): wmpnscfg.exe, dllhost.exe, WMIADAP.exe, conhost.exe, mscorsvw.exe, VSSVC.exe, svchost.exe, mobsync.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtFsControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtQueryVolumeInformationFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: infinstaller.exe

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	68	0 - 100	Report FP / FN	false

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Command-Line Interface1	Bootkit1	Process Injection1	Disabling Security Tools21	Input Capture11	Account Discovery1	Application Deployment Software	Input Capture11	Data Compressed	Standard Cryptographic Protocol1
Replication Through Removable Media	Service Execution	Modify Existing Service2	New Service1	Process Injection1	Network Sniffing	Security Software Discovery21	Remote Services	Clipboard Data1	Exfiltration Over Other Network Medium	Standard Non-Application Layer Protocol1
Drive-by Compromise	Windows Management Instrumentation	New Service1	Path Interception	Obfuscated Files or Information2	Input Capture	Remote System Discovery1	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Standard Application Layer Protocol1
Exploit Public-Facing Application	Scheduled Task	System Firmware	DLL Search Order Hijacking	Obfuscated Files or Information	Credentials in Files	System Information Discovery23	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication

Signature Overview

Click to jump to signature section

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: asushotfix.com

virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: Setup.exe

virustotal: Detection: 41%

Perma Link

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01272650 FindFirstFileW,FindClose,		16_2_01272650
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01272B00 _memset,_memset,SHGetSpecialFolderPathW,wsprintfW,wsprintfW,FindFirstFileW,wsprintfW,CoInitialize,CoCreateInstance,_wcsnlen,GetCurrentProcessId,EnumWindows,SHDeleteValueW,CoUninitialize,DeleteFileW,wsprintfW,RemoveDirectoryW,RemoveDirectoryW,wsprintfW,RemoveDirectoryW,FindClose,SHDeleteKeyW,SHDeleteKeyW,SHDeleteKeyW,		16_2_01272B00

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2027109 ET TROJAN ShadowHammer DNS Lookup 192.168.1.13:61365 -> 8.8.8.8:53

Found strings which match to known social media urls

Show sources

Source: infinstaller.exe, 00000005.00000002.653565680.00000000004AD000.00000004.sdmp	String found in binary or memory: Microsoft.AspNet.Mvc.Facebook equals www.facebook.com (Facebook)
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: dns.msftncsi.com

Urls found in memory or binary data

Show sources

Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: infinstaller.exe, 00000005.00000002.658715071.000000001BED0000.00000004.sdmp, drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: drvinst.exe, 0000000B.00000002.617547657.000000000009E000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: drvinst.exe, 0000000B.00000002.617547657.000000000009E000.00000004.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en008R2
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://ocsp.ver
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: Setup.exe, 00000010.00000002.745599656.0000000000691000.00000004.sdmp	String found in binary or memory: https://asushotfix.com/logo2.jpg?3A8EA62E32B4ECBE33DF500A28EBC873
Source: Setup.exe, 00000010.00000002.745599656.0000000000691000.00000004.sdmp	String found in binary or memory: https://asushotfix.com/logo2.jpg?3A8EA62E32B4ECBE33DF500A28EBC873rj
Source: drvinst.exe, 0000000B.00000002.618771824.0000000000108000.00000004.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: Setup.exe	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_012E4052 __EH_prolog3_catch_GS,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,

16_2_012E4052

Contains functionality to retrieve information about pressed keystrokes

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_012DC0F5 GetAsyncKeyState,

16_2_012DC0F5

E-Banking Fraud:

Drops certificate files (DER)

Show sources

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFEB9.tmp	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\Users\user\Downloads\net\netvirtnet64.cat	Jump to dropped file
Source: C:\Users\user\Downloads\net\infinstaller.exe	File created: C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\SETFD71.tmp	Jump to dropped file

System Summary:

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Show sources

Source: C:\Windows\System32\7za.exe	Memory allocated: 776C0000 page execute and read and write	Jump to behavior
Source: C:\Windows\System32\7za.exe	Memory allocated: 775C0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Memory allocated: 776C0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Memory allocated: 775C0000 page execute and read and write	Jump to behavior

Creates driver files

Show sources

Source: C:\Windows\System32\7za.exe

File created: C:\Users\user\Downloads\net\virtnet.sys

Jump to behavior

Creates files inside the driver directory

Show sources

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}

Jump to behavior

Creates files inside the system directory

Show sources

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}

Jump to behavior

Creates mutexes

Show sources

Source: C:\Windows\System32\drvinst.exe

Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}

Deletes files inside the Windows folder

Show sources

Source: C:\Windows\System32\drvinst.exe

File deleted: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFEB9.tmp

Jump to behavior

Detected potential crypto function

Show sources

Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01273800	16_2_01273800
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_0136C3B9	16_2_0136C3B9
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012D674A	16_2_012D674A
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012A29FD	16_2_012A29FD
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012D4B8A	16_2_012D4B8A
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012FCEB8	16_2_012FCEB8

Enables driver privileges

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

Process token adjusted: Load Driver

Jump to behavior

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Downloads\Setup.exe	Code function: String function: 0136966A appears 74 times
Source: C:\Users\user\Downloads\Setup.exe	Code function: String function: 01271680 appears 33 times
Source: C:\Users\user\Downloads\Setup.exe	Code function: String function: 01369601 appears 200 times

PE file contains strange resources

Show sources

Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

PE file does not import any functions

Show sources

Source: infinstaller.exe.4.dr

Static PE information: No import functions for PE file found

Reads the hosts file

Show sources

Source: C:\Users\user\Downloads\Setup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Sample file is different than original file name gathered from version info

Show sources

Source: Setup.exe, 00000010.00000001.737819959.00000000013DE000.00000002.sdmp	Binary or memory string: OriginalFilenameSelfUpdt.EXE vs Setup.exe
Source: Setup.exe, 00000010.00000002.745148975.0000000000150000.00000008.sdmp	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs Setup.exe
Source: Setup.exe	Binary or memory string: OriginalFilenameSelfUpdt.EXE vs Setup.exe

Spawns drivers

Show sources

Source: unknown

Driver loaded: C:\Windows\system32\DRIVERS\virtnet.sys

Binary contains device paths (device paths are often used for kernel mode <-> user mode communication)

Show sources

Source: metadata-2.6.dr	Binary string: buttonup_off.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.6.dr	Binary string: scenes_intro_bg_pal.wmv22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.6.dr	Binary string: acxtrnal.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\((windows\diagnostics\system\device\en-us
Source: metadata-2.6.dr	Binary string: sbdrop.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.6.dr	Binary string: system.web.dynamicdata.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images33docked_black_moon-waxing-gibbous_partly-cloudy.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}
Source: metadata-2.6.dr	Binary string: system.addin.contract.dll22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\QQprogramdata\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}
Source: metadata-2.6.dr	Binary string: wmplayer.exe.mui22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\BBprogram files (x86)\windows sidebar\gadgets\weather.gadget\images**undocked_black_moon-new_partly-cloudy.png22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\((windows\diagnostics\system\device\en-us

Classification label

Show sources

Source: classification engine

Classification label: mal68.evad.winEXE@13/20@7/2

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_01274480 SetFileAttributesW,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,GetTokenInformation,SetSecurityDescriptorOwner,SetFileSecurityW,AdjustTokenPrivileges,GetLastError,

16_2_01274480

Contains functionality to instantiate COM classes

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0127E37E CoInitialize,CoCreateInstance,

16_2_0127E37E

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_012865DC FindResourceW,LoadResource,LockResource,FreeResource,

16_2_012865DC

Creates files inside the user directory

Show sources

Source: C:\Windows\System32\7za.exe

File created: C:\Users\user\Downloads\net

Jump to behavior

Creates temporary files

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

File created: C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}

Jump to behavior

Found command line output

Show sources

Source: C:\Windows\System32\cmd.exe	Console Write: ..................<J............M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .[.V.e.r.s.i.o.n. .6...1...7.6.0.1.]. .,.......,.....H.........,.............	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............................d16.......................MD............`{?J......?J............X.,...............,.............	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............................d16.......................MD............`{?J......?J....................~.........,.............	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............................d16.......................MD............`{?J......?J............X.,...............,.............	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............................X.......................0.MD....@..O......?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........H.........>J.... .@J..............,.....(.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x.................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.W.i.n.d.o.w.s.>...........................H.......t.>J.... .@J..............,.......................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.>.........f.>J............................H.......f.>J.... .@J..............,.......................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.d. .U.s.e.r.s......... ...............>.......................................8.,.............2l>J......N.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.U.s.e.r.s.>.>J............................H.......p.>J.... .@J..............,.......................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.d. .h.a.n.s.p.e.t.e.r. .......................................................8.,.............2l>J......N.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.>...........H.........>J.... .@J..............,.....&.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.d. .D.o.w.n.l.o.a.d.s. .......................................................8.,.............2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................x...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.>.>J.... .@J..............,.....:.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................<J....................................@c@J..... ........,..............qRw............0.,.............X.......................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X.................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.>.>J.... .@J..............,.....:.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................7.z.a. .x. .n.e.t...z.i.p.......................................................8.,.............2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.>.>J.... .@J..............,.....:.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................c.d. .n.e.t.......&..... .......................................................8.,.............2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................X...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................i.n.f.i.n.s.t.a.l.l.e.r...e.x.e.................................................8.,..... .......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................i.n.f.i.n.s.t.a.l.l.e.r...e.x.e. .C.:.\.U.s.e.r.s...............................8.,.....2.......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................i.n.f.i.n.s.t.a.l.l.e.r...e.x.e. .".C.:.\.U.s.e.r.s.\.A.l.l. .U.s.e.r.s.".......8.,.....J.......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................i.n.f.i.n.s.t.a.l.l.e.r...e.x.e. .C.:.\.U.s.e.r.s.\.D.e.f.a.u.l.t.(.............8.,.....B.......2l>J......(.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................i.n.f.i.n.s.t.a.l.l.e.r...e.x.e. .C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r...........8.,.....F.......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................!.(..... ...(...........................................................Z.......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................!.(..... ...0...........f...............................................b.......2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................!.(..... ...3...................................!...............................2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................................!.(..... ...C........... .......................!.(.............................2l>J......(.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................,.................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................,...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................L.................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................L...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................l...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................<J....................................@c@J..... ........,..............qRw............ .,.....................................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................l.................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................l...............C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.\.n.e.t.>.@J..............,.....B.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.>.>J.... .@J..............,.....:.................>J....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................S.e.t.u.p...e.x.e....... ................C......................................8.,.............2l>J......O.....	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ..................................................N.....................0.MD..............?J......?J..............,.............................	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Console Write: ................................C.:.\.U.s.e.r.s.\.h.a.n.s.p.e.t.e.r.\.D.o.w.n.l.o.a.d.s.>.>J.... .@J..............,.....:.................>J....	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ....................................W.i.n.d.o.w.s. .I.P. .C.o.n.f.i.g.u.r.a.t.i.o.n.....................................<.......x...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................X...............0.6.....(.P..............................3..............................................^.......................	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................X...............0.6.....(.P..............................4..............................................R.......................	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................X...............0.6.....(.P.............................#4..............................................^.......................	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................X...............0.6.....(.P.............................+4..............................................V.......................	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................X...............0.6.....(.P.............................14..............................................V.......................	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................b4..............................................^.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................h4..............................................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................n4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................t4..............................................t.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................z4..............................................X.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................X.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................h.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..........................2.E.................d.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..............................................`.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................Z.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................t.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................V.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................4..............................................X.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4......................................................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..............................................l.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..............................................h.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..........................D.5.................`.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................4..........................D.5.................`.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P..............................5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................5..........................D.5.................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................5..........................D.5.................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................#5..........................D.5.................V.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................)5..........................D.5.................X.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P............................./5..........................D.5.................n.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................55..........................D.5.................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................@5..........................D.5.................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................F5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................L5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................R5..........................D.5.................V.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................X5..........................D.5.................X.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ..................................7.....(.P.............................^5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................d5..........................D.5.................v.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................j5..........................D.5.................R.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................p5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................v5..........................D.5.........................(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P.............................\|5..........................D.5.................V.......(...............	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Console Write: ................................0.6.....(.P..............................5..........................D.5.................X.......(...............	Jump to behavior

PE file has an executable .text section and no other executable section

Show sources

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\f89061884b75dab0e3967d7221e5290d\mscorlib.ni.dll

Jump to behavior

Reads ini files

Show sources

Source: C:\Users\user\Downloads\Setup.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Runs a DLL by calling functions

Show sources

Source: unknown

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat

Sample is known by Antivirus

Show sources

Source: Setup.exe

virustotal: Detection: 41%

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe'
Source: unknown	Process created: C:\Windows\System32\7za.exe 7za x net.zip
Source: unknown	Process created: C:\Users\user\Downloads\net\infinstaller.exe infinstaller.exe C:\Users\user\Downloads\net\netVirtNet1.inf
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe '4' '0' 'C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\netvirtnet1.inf' '9' '6cfbba9e7' '00000000000003E4' 'WinSta0\Default' '00000000000005C8' '208' 'c:\users\user\downloads\net'
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe '2' '211' 'ROOT\NET\0000' 'C:\Windows\INF\oem4.inf' 'netvirtnet1.inf:NTKR.NTAMD64:virtnet.ndi:1.0.0.0:nm_virtnet' '6cfbba9e7' '00000000000003E4' '00000000000005D0' '0000000000000570'
Source: unknown	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: unknown	Process created: C:\Users\user\Downloads\Setup.exe Setup.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za x net.zip	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\net\infinstaller.exe infinstaller.exe C:\Users\user\Downloads\net\netVirtNet1.inf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\Setup.exe Setup.exe	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\drvinst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\InprocServer32

Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

PE file has a big code size

Show sources

Source: Setup.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Show sources

Source: Setup.exe

Static file information: File size 3333936 > 1048576

PE file has a big raw section

Show sources

Source: Setup.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x11aa00
Source: Setup.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1a0600

PE file imports many functions

Show sources

Source: Setup.exe

Static PE information: More than 200 imports for USER32.dll

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Setup.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Show sources

Source:	Binary string: D:\projects\VirtNet\bin\amd64\virtnet.pdb source: 7za.exe, 00000004.00000003.382744292.0000000000100000.00000004.sdmp, SETE957.tmp.11.dr
Source:	Binary string: c:\Users\admin\Documents\SharpDevelop Projects\test1\test1\obj\Debug\test1.pdb source: infinstaller.exe, 00000005.00000001.459151771.0000000001092000.00000020.sdmp, infinstaller.exe.4.dr

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_012DE296 push 3BFFFFFFh; iretd

16_2_012DE29B

Persistence and Installation Behavior:

Uses ipconfig to lookup or modify the Windows network settings

Show sources

Source: unknown

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Drops PE files

Show sources

Source: C:\Windows\System32\7za.exe	File created: C:\Users\user\Downloads\net\virtnet.sys	Jump to dropped file
Source: C:\Users\user\Downloads\net\infinstaller.exe	File created: C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\SETFD81.tmp	Jump to dropped file
Source: C:\Windows\System32\7za.exe	File created: C:\Users\user\Downloads\net\infinstaller.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFED9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETE957.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFED9.tmp			Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\SETE957.tmp			Jump to dropped file

May use bcdedit to modify the Windows boot settings

Show sources

Source: metadata-2.6.dr

Binary or memory string: bcdedit.exe22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\

Contains functionality to read ini properties file for application configuration

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_01273800 _memset,_memset,_memset,PathFileExistsW,PathFileExistsW,PathFileExistsW,_memset,DeleteFileW,_memset,GetPrivateProfileStringW,_memset,_memset,GetWindowsDirectoryW,lstrcatW,GetModuleFileNameW,_wcsnlen,_wcsrchr,GetVersion,ShellExecuteW,

16_2_01273800

Boot Survival:

Creates or modifies windows services

Show sources

Source: C:\Windows\System32\drvinst.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher

Jump to behavior

Modifies existing windows services

Show sources

Source: C:\Windows\System32\drvinst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Show sources

Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012AE06E GetClientRect,IsRectEmpty,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,IsRectEmpty,EqualRect,GetWindowRect,GetParent,EndDeferWindowPos,	16_2_012AE06E
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C831C GetParent,GetParent,IsIconic,GetParent,	16_2_012C831C
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012B2290 IsWindowVisible,IsIconic,	16_2_012B2290
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C240F IsIconic,PostMessageW,	16_2_012C240F
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C04F4 IsWindow,GetFocus,IsChild,SendMessageW,IsChild,SendMessageW,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,	16_2_012C04F4
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01298DD7 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	16_2_01298DD7
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C0F83 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	16_2_012C0F83
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C0F83 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	16_2_012C0F83
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_012C0F83 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	16_2_012C0F83

Extensive use of GetProcAddress (often used to hide API calls)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0127F4B4 __EH_prolog3_GS,GetDeviceCaps,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,_memset,GetTextCharsetInfo,lstrcpyW,lstrcpyW,EnumFontFamiliesW,EnumFontFamiliesW,lstrcpyW,EnumFontFamiliesW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,CreateFontIndirectW,GetSystemMetrics,lstrcpyW,CreateFontIndirectW,GetStockObject,GetStockObject,GetObjectW,GetObjectW,lstrcpyW,CreateFontIndirectW,CreateFontIndirectW,GetStockObject,GetObjectW,CreateFontIndirectW,CreateFontIndirectW,__EH_prolog3_GS,GetVersionExW,KiUserCallbackDispatcher,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_0127F4B4

Stores large binary data to the registry

Show sources

Source: C:\Windows\System32\drvinst.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network Config

Jump to behavior

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Checks the free space of harddrives

Show sources

Source: C:\Windows\System32\drvinst.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe	Dropped PE file which has not been started: C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\SETFD81.tmp			Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFED9.tmp			Jump to dropped file

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_16-31877

Found large amount of non-executed APIs

Show sources

Source: C:\Users\user\Downloads\Setup.exe

API coverage: 5.7 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe TID: 2412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\drvinst.exe TID: 2476	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\System32\drvinst.exe TID: 2476	Thread sleep time: -2340000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe TID: 1556	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe TID: 1556	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe TID: 1572	Thread sleep time: -1500000s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\Setup.exe TID: 1572	Thread sleep time: -60000s >= -30000s	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01272650 FindFirstFileW,FindClose,		16_2_01272650
Source: C:\Users\user\Downloads\Setup.exe	Code function: 16_2_01272B00 _memset,_memset,SHGetSpecialFolderPathW,wsprintfW,wsprintfW,FindFirstFileW,wsprintfW,CoInitialize,CoCreateInstance,_wcsnlen,GetCurrentProcessId,EnumWindows,SHDeleteValueW,CoUninitialize,DeleteFileW,wsprintfW,RemoveDirectoryW,RemoveDirectoryW,wsprintfW,RemoveDirectoryW,FindClose,SHDeleteKeyW,SHDeleteKeyW,SHDeleteKeyW,		16_2_01272B00

Contains functionality to query system information

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0136CB07 VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

16_2_0136CB07

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: infinstaller.exe, 00000005.00000002.654051633.0000000000502000.00000004.sdmp	Binary or memory string: ROOT\LEGACY_VMWAREAUTH\0000
Source: drvinst.exe, 00000006.00000003.508886036.00000000017BC000.00000004.sdmp	Binary or memory string: microsoft-hyper-v-migration-replacement.man
Source: metadata-2.6.dr	Binary or memory string: lsm.exe22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests,,microsoft-hyper-v-migration-replacement.man22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\
Source: metadata-2.6.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\--windows\system32\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\##windows\system32\spp\tokens\ppdlic
Source: metadata-2.6.dr	Binary or memory string: iasmigplugin-dl.man22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\--windows\syswow64\migwiz\replacementmanifests33microsoft-hyper-v-client-migration-replacement.man22\\?\Volume{4d4a291d-7dbc-11e1-a697-806e6f6e6963}\,,program files (x86)\internet explorer\en-us

Program exit points

Show sources

Source: C:\Users\user\Downloads\Setup.exe

API call chain: ExitProcess graph end node

graph_16-31876

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0136EA27 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_0136EA27

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0136CB07 VirtualProtect ?,-00000001,00000104,?

16_2_0136CB07

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0136EA27 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

16_2_0136EA27

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Show sources

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za x net.zip	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\net\infinstaller.exe infinstaller.exe C:\Users\user\Downloads\net\netVirtNet1.inf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Downloads\Setup.exe Setup.exe	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Show sources

Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat
Source: C:\Windows\System32\drvinst.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{5d5a63fc-7ebe-5905-74c9-9936171bf316} Global\{0a6852b4-0342-09c6-94d5-2f292fdc7b02} C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet1.inf C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\netvirtnet64.cat			Jump to behavior

Contains functionality to add an ACL to a security descriptor

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_012745E0 _memset,_memset,InitializeSecurityDescriptor,LookupAccountNameW,SetFileAttributesW,GetLengthSid,InitializeAcl,AddAccessAllowedAce,SetSecurityDescriptorDacl,SetFileSecurityW,

16_2_012745E0

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: GetLocaleInfoW,__snwprintf_s,LoadLibraryW,

16_2_01274D46

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe	Queries volume information: C:\Users\user\Downloads\net\infinstaller.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Queries volume information: C:\Users\user\Downloads\net\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Queries volume information: C:\Users\user\Downloads\net\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Queries volume information: C:\Windows\System32\DriverStore\FileRepository\netvirtnet1.inf_amd64_neutral_55f5524394231d93\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\net\infinstaller.exe	Queries volume information: C:\Windows\System32\DriverStore\FileRepository\netvirtnet1.inf_amd64_neutral_55f5524394231d93\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\FileRepository\netvirtnet1.inf_amd64_neutral_55f5524394231d93\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\FileRepository\netvirtnet1.inf_amd64_neutral_55f5524394231d93\netvirtnet64.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT VolumeInformation	Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Downloads\Setup.exe

Code function: 16_2_0136C70D GetSystemTimeAsFileTime,__aulldiv,

16_2_0136C70D

Contains functionality to query the account / user name

Show sources

Source: C:\Users\user\Downloads\Setup.exe

16_2_012745E0

Contains functionality to query windows version

Show sources

Source: C:\Users\user\Downloads\Setup.exe

16_2_0127F4B4

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Downloads\net\infinstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Adds / modifies Windows certificates

Show sources

Source: C:\Windows\System32\drvinst.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Blob

Jump to behavior

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
15:22:34	API Interceptor	1x Sleep call for process: 7za.exe modified
15:23:07	API Interceptor	1x Sleep call for process: infinstaller.exe modified
15:23:08	API Interceptor	327x Sleep call for process: drvinst.exe modified
15:23:09	API Interceptor	1x Sleep call for process: rundll32.exe modified
15:24:38	API Interceptor	5x Sleep call for process: ipconfig.exe modified
15:25:03	API Interceptor	34x Sleep call for process: Setup.exe modified

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Setup.exe	41%	virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\SETFD81.tmp	0%	virustotal	Browse
C:\Users\user~1\AppData\Local\Temp\{55b76fcb-15ca-13b2-f5e3-4f2c32e01445}\SETFD81.tmp	0%	metadefender	Browse
C:\Users\user\Downloads\net\virtnet.sys	0%	metadefender	Browse
C:\Windows\System32\DriverStore\Temp\{63a5b06f-2f1a-44aa-e741-2e65e6af082c}\SETFED9.tmp	0%	metadefender	Browse
C:\Windows\System32\drivers\SETE957.tmp	0%	metadefender	Browse

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
asushotfix.com	13%	virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://asushotfix.com/logo2.jpg?3A8EA62E32B4ECBE33DF500A28EBC873	0%	Avira URL Cloud	safe
https://asushotfix.com/logo2.jpg?3A8EA62E32B4ECBE33DF500A28EBC873rj	0%	Avira URL Cloud	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
1.0.0.0	VHHyfEe6kw.rtf	Get hash	malicious	Browse
	VHHyfEe6kw.rtf	Get hash	malicious	Browse
	oWwsW39bEi.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dns.msftncsi.com	42Order Sample Picture.exe	Get hash	malicious	Browse	131.107.255.255
	5NEW PO.exe	Get hash	malicious	Browse	131.107.255.255
	61redacted@threatwav.exe	Get hash	malicious	Browse	131.107.255.255
	37pobrien@orbtec.exe	Get hash	malicious	Browse	131.107.255.255
	25edgegloba.exe	Get hash	malicious	Browse	131.107.255.255
	103srd.exe	Get hash	malicious	Browse	131.107.255.255
	46Bestellung-0857893850.scr	Get hash	malicious	Browse	131.107.255.255
	78bmuxgvmkey.exe	Get hash	malicious	Browse	131.107.255.255
	25transcrip.exe	Get hash	malicious	Browse	131.107.255.255
	25transcrip.exe	Get hash	malicious	Browse	131.107.255.255
	39transcrip.exe	Get hash	malicious	Browse	131.107.255.255
	ACH form.doc	Get hash	malicious	Browse	131.107.255.255
	69PO#32893489339222.scr	Get hash	malicious	Browse	131.107.255.255
	79Purchase Enquiry.pdf.exe	Get hash	malicious	Browse	131.107.255.255
	17Transfer Copy.jar.jar	Get hash	malicious	Browse	131.107.255.255
	109gkcotcntx.exe	Get hash	malicious	Browse	131.107.255.255
	109gkcotcntx.exe	Get hash	malicious	Browse	131.107.255.255
	101iemand@voorbeel.exe	Get hash	malicious	Browse	131.107.255.255
	25edgegloba.exe	Get hash	malicious	Browse	131.107.255.255
	73PO# JUL20170714 (2).exe	Get hash	malicious	Browse	131.107.255.255

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
unknown	Invoice0186.pdf	Get hash	malicious	Browse	192.168.0.40
	P_2038402.xlsx	Get hash	malicious	Browse	192.168.0.44
	bad.pdf	Get hash	malicious	Browse	192.168.0.44
	RFQ.pdf	Get hash	malicious	Browse	192.168.0.44
	100323.pdf	Get hash	malicious	Browse	192.168.0.44
	Copy.pdf	Get hash	malicious	Browse	127.0.0.1
	2.exe	Get hash	malicious	Browse	192.168.0.40
	UPPB502981.doc	Get hash	malicious	Browse	192.168.0.44
	Adm_Boleto.via2.com	Get hash	malicious	Browse	192.168.0.40
	00ECF4AD.exe	Get hash	malicious	Browse	192.168.0.40
	PDF_100987464500.exe	Get hash	malicious	Browse	192.168.0.40
	filedata.exe	Get hash	malicious	Browse	192.168.0.40
	.exe	Get hash	malicious	Browse	192.168.1.60
	33redacted@threatwave.com	Get hash	malicious	Browse	192.168.1.71
unknown	Invoice0186.pdf	Get hash	malicious	Browse	192.168.0.40
	P_2038402.xlsx	Get hash	malicious	Browse	192.168.0.44
	bad.pdf	Get hash	malicious	Browse	192.168.0.44
	RFQ.pdf	Get hash	malicious	Browse	192.168.0.44
	100323.pdf	Get hash	malicious	Browse	192.168.0.44
	Copy.pdf	Get hash	malicious	Browse	127.0.0.1
	2.exe	Get hash	malicious	Browse	192.168.0.40
	UPPB502981.doc	Get hash	malicious	Browse	192.168.0.44
	Adm_Boleto.via2.com	Get hash	malicious	Browse	192.168.0.40
	00ECF4AD.exe	Get hash	malicious	Browse	192.168.0.40
	PDF_100987464500.exe	Get hash	malicious	Browse	192.168.0.40
	filedata.exe	Get hash	malicious	Browse	192.168.0.40
	.exe	Get hash	malicious	Browse	192.168.1.60
	33redacted@threatwave.com	Get hash	malicious	Browse	192.168.1.71

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Setup.exe

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Signature Similarity

Similar Samples

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails