Windows Analysis Report
UmiDataServer v1.0.1.1.exe

ID:	1417094
Product:	CloudBasic
Start time:	15:54:09
Start date:	28.03.2024
Sample:	UmiDataServer v1.0.1.1.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	75c876a06f5679e880e91897c83789b1
SHA1:	13703a9cac7af619e4e79f3dde2dc7890277b448
SHA256:	258fd554afd7aaf894c069a35b2e1ba65fb9f0dd5bb11f9573d800088f18277e
Filetype:	Win32 Executable (generic) a (10002005/4) 98.04%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Temp\is-IKNN5.tmp\_isetup\_setup64.tmp	PE32+ executable (console) x86-64, for MS Windows	E4211D6D009757C078A9FAC7FF4F03D4	019CD56BA687D39D12D4B13991C9A42EA6BA03DA	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	B55AB2B088236C1B8E96319049824AAA	6A86BB9499B9753C17BFEFB27C0902A4BBD0A6D2	EA28E21CD84A550B9390B3AE8663A497B4663B7233082230DD6B0812A01F7FAF

Compliance

Source: UmiDataServer v1.0.1.1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: UmiDataServer v1.0.1.1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

System Summary

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Section loaded: dwmapi.dll

Source: UmiDataServer v1.0.1.1.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: clean2.winEXE@3/2@0/0

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe

File created: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe

File read: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe

Source: unknown	Process created: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe "C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe"
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp "C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp" /SL5="$4036E,4640132,832512,C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe"
Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Process created: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp "C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp" /SL5="$4036E,4640132,832512,C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe"

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

Window found: window name: TMainForm

Source: UmiDataServer v1.0.1.1.exe

Static file information: File size 5481832 > 1048576

Source: UmiDataServer v1.0.1.1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: UmiDataServer v1.0.1.1.exe

Static PE information: section name: .didata

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	File created: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IKNN5.tmp\_isetup\_setup64.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\UmiDataServer v1.0.1.1.exe	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\AppData\Local\Temp\is-IUSS4.tmp\UmiDataServer v1.0.1.1.tmp

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IKNN5.tmp\_isetup\_setup64.tmp

Jump to dropped file