Analysis Report Setup.exe

ID:	358589
Product:	CloudBasic
Start time:	21:57:47
Start date:	25.02.2021
Sample:	Setup.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	7b5d30bd9b7cdcca79e189aaaf5707fa
SHA1:	45fe889c3660be692ba30bb6bcdc2b51380c214e
SHA256:	a6385ebfc0c6e766e9f068ad348a53e39a18875da5e3759428633984c0b075aa
Filetype:	Win32 Executable (generic) a (10002005/4) 99.53%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\Star4Live\Star4Live_P2P\log\p2plog_20210225-215854.1636	ASCII text, with CRLF line terminators	4E61E2267500AE1D97328057C416826A	B4304C253D27CE2F4E326207425E244E9EA6D9C5	B680954FC0C1B9D905609014B68DBB16B9BEED694A06631A94A219F9F1BD99ED
C:\ProgramData\Microsoft\Network\Downloader\edb.log	data	87658B0EF52FF2207F7C0E05251F91E8	CDE1D1C3B20E38A13A50EE9EE05F601B9C230C2D	31C87B83AD51FD46294150292440A95B7DB7E5B41BF9091A5986FA9435E180FB
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db	Extensible storage engine DataBase, version 0x620, checksum 0x7f72b25f, page size 16384, DirtyShutdown, Windows version 10.0	5367189EBC18CB591DB7857DDB1C0C81	8BE339EDE8A5E0029E7E3158AA33C4D31E0BCF1C	39FD24BB07EFC8C77F71EF060AED04DFFED8921FA6906A51F94AFA10D0646316
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm	data	D79A24EB79A375F59BB4E2921FF76312	95ECB286EFEAEC62BE3E7EADF977CF6F12915783	0DFE523DBC951B90FAC72CE0D531B5E05C445254A1D0673A1FF997595379F66B
C:\Users\user\AppData\Local\Downloaded Installations\{877F9BE8-C6E2-462D-9A96-09E42390D002}\Star4Live_P2P.msi	Intel;1033	7980E58F7A7A619D21360EA557EB6D14	1104563E1CD52A3174DC2C998CFC2C94238F4AC6	17263403F97F57C23FD20C09D063805A24E083FB23ABFD3E4069B68381F692EF
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl	data	AE43C15CDF4DCEAA79848D82AC05CEBE	488368599190E000EF11016658D1B54E6C445969	01B20327D30557A171734057B9A7A4C24BD36745897CB73424019D9859EF6FFF
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl	data	006591B85AEE4C755D9D0FCFD4E6960B	4721917B747140CDFA4D60AD8C492D290D1FCEB8	A20EDDF428C8AD104073D97ED8C8117CE4EEFC6D7193EDA9A2E593A1D1FC01B5
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl	data	BEF68CE3004440C64AA8113734E2063E	D71E5548E0287D1421524ADD354C455901047436	E159E42261B950E66A7B714848248B622A88E3B062B354808BA02FB52607ABA6
C:\Users\user\AppData\Local\Temp\MSI1304.tmp	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	778D0941FB9B969AB90B81C9B91086D7	02B755BE2046F5B34F5884AF9137ED014023E2E1	3A2EB487237D36B6DA8CC21EB39AFDB890A84BF2E29FADF3182E44B1EF114FB8
C:\Users\user\AppData\Local\Temp\MSI715f3.LOG	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators	E8FB56C24773DFF2E1FBB38C5D657AA9	EEEAF27F51C4350F9AB5DFF463CDCC1BFDBDF1EE	104F3794C8A2F57356FBCF753A67A4A78904A2E87A2399629054F843A44E6E03
C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\0x0409.ini	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators	BE345D0260AE12C5F2F337B17E07C217	0976BA0982FE34F1C35A0974F6178E15C238ED7B	E994689A13B9448C074F9B471EDEEC9B524890A0D82925E98AB90B658016D8F3
C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\Setup.INI	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	DCBA353F2B7EADE8FE50D59107AAFCF2	93260BC97E343BCAB65179A8E84D014B8F2B839D	46342A1CEE706944285ABAA51C1E02C0BE9AF43F48ACFD97AC2AFC0B10C31B45
C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\Star4Live_P2P.msi	Intel;1033	7980E58F7A7A619D21360EA557EB6D14	1104563E1CD52A3174DC2C998CFC2C94238F4AC6	17263403F97F57C23FD20C09D063805A24E083FB23ABFD3E4069B68381F692EF
C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\_ISMSIDEL.INI	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	077E0E8202E2636BE1A5AB5594F7FDA3	8F32ED8E55CCB85DE61C7B7F1D4F50B2F7C286BA	8540397DE3619048525551C3CB58987231604A7A870F274181DA2A0DA6302112
C:\Users\user\AppData\Local\Temp\~F49E.tmp	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	DCBA353F2B7EADE8FE50D59107AAFCF2	93260BC97E343BCAB65179A8E84D014B8F2B839D	46342A1CEE706944285ABAA51C1E02C0BE9AF43F48ACFD97AC2AFC0B10C31B45
C:\Users\user\AppData\Local\Temp\~F4CE.tmp	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	DCBA353F2B7EADE8FE50D59107AAFCF2	93260BC97E343BCAB65179A8E84D014B8F2B839D	46342A1CEE706944285ABAA51C1E02C0BE9AF43F48ACFD97AC2AFC0B10C31B45
C:\Users\user\AppData\Local\Temp\~FC32.tmp	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators	DCBA353F2B7EADE8FE50D59107AAFCF2	93260BC97E343BCAB65179A8E84D014B8F2B839D	46342A1CEE706944285ABAA51C1E02C0BE9AF43F48ACFD97AC2AFC0B10C31B45
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	ASCII text, with no line terminators	DCA83F08D448911A14C22EBCACC5AD57	91270525521B7FE0D986DB19747F47D34B6318AD	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
\Device\ConDrv	ASCII text, with CRLF line terminators	102A76544A6788499EAE34CFC9CE5EAD	91522965860BC7D33334C6AC8D28314A0CA45F5F	73B22483CA5FDA42A40744D2AADA12D852DC3C1C0D27DA2CE99400FC0F99E15F

Compliance:

Uses 32bit PE files

Source: Setup.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Unicode\setup.pdb source: Setup.exe
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: Star4Live_P2P.msi0.0.dr

Spreading:

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004221BF __EH_prolog3,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,

0_2_004221BF

Networking:

Urls found in memory or binary data

Source: MSI1304.tmp.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 00000019.00000002.470773517.0000029D7CA14000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000019.00000002.470773517.0000029D7CA14000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000019.00000002.470773517.0000029D7CA14000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: MSI1304.tmp.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: svchost.exe, 00000019.00000002.470491719.0000029D7C980000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 00000019.00000002.466584853.0000029D7B2A0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/enumeration/Enumerate
Source: MSI1304.tmp.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: MSI1304.tmp.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: MSI1304.tmp.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: svchost.exe, 0000001F.00000002.310869374.000001DB23613000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: MSI1304.tmp.2.dr	String found in binary or memory: http://www.flexerasoftware.com0
Source: Setup.exe	String found in binary or memory: http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
Source: Setup.exe, 00000000.00000002.263650863.000000000088A000.00000004.00000020.sdmp, msiexec.exe, 00000002.00000003.254356751.000000000341F000.00000004.00000001.sdmp	String found in binary or memory: http://www.star4live.com
Source: msiexec.exe, 00000002.00000003.212346389.00000000033EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.star4live.comi4w
Source: svchost.exe, 0000001C.00000002.466340191.00000268B822A000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000001C.00000002.466340191.00000268B822A000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000001C.00000002.466340191.00000268B822A000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000001C.00000002.466340191.00000268B822A000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000001C.00000002.466340191.00000268B822A000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000001F.00000003.310023457.000001DB2364B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000001F.00000002.310932690.000001DB2363E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000001F.00000003.310023457.000001DB2364B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000001F.00000002.310932690.000001DB2363E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000001F.00000002.310942420.000001DB23642000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000001F.00000002.310942420.000001DB23642000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000001F.00000003.310512253.000001DB23646000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000001F.00000003.310023457.000001DB2364B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000001F.00000003.310512253.000001DB23646000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000001F.00000003.310512253.000001DB23646000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000001F.00000002.310997843.000001DB23664000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.310942420.000001DB23642000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.310518653.000001DB23641000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000001F.00000003.309978164.000001DB23660000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000001F.00000002.310932690.000001DB2363E000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000001F.00000003.286601390.000001DB23631000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000001F.00000002.310932690.000001DB2363E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000001F.00000002.310932690.000001DB2363E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.310869374.000001DB23613000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000001F.00000003.310525588.000001DB23645000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000001F.00000003.310525588.000001DB23645000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000001F.00000003.286601390.000001DB23631000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000001F.00000003.286601390.000001DB23631000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000001F.00000003.310023457.000001DB2364B000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

System Summary:

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004480D2 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004480D2

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0042C46B		0_2_0042C46B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_0049BDC0		0_2_0049BDC0

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00401850 appears 62 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 004674D0 appears 66 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00409071 appears 44 times

PE file contains strange resources

Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Setup.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Uses 32bit PE files

Source: Setup.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: sus24.evad.winEXE@44/20@0/1

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004480D2 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,

0_2_004480D2

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004437CD LoadLibraryW,GetProcAddress,lstrcpyW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FreeLibrary,

0_2_004437CD

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00417786 FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00417786

Creates files inside the program directory

Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe

File created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\log

Jump to behavior

Creates files inside the user directory

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Downloaded Installations

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6208:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4084:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6312:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2992:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\

Jump to behavior

Might use command line arguments

Source: C:\Users\user\Desktop\Setup.exe	Command line argument: debuglog		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: runfromtemp		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: reboot		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: %s%s		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: tempdisk1folder		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: ISSetup.dll		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: ISSetup.dll		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: Skin		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: Startup		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: setup.isn		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: count		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: Languages		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: key%d		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: Languages		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: %s\0x%04x.ini		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: %s\0x%04x.ini		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: %s\%04x.mst		0_2_0043E4C0
Source: C:\Users\user\Desktop\Setup.exe	Command line argument: %s\%04x.mst		0_2_0043E4C0

PE file has an executable .text section and no other executable section

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries process information (via WMI, Win32_Process)

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CloudHttpServer.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CloudHttpWindowPopup.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CloudHttpServer.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "CloudHttpWindowPopup.exe")

Reads ini files

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\Setup.INI

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample reads its own file content

Source: C:\Users\user\Desktop\Setup.exe

File read: C:\Users\user\Desktop\Setup.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Setup.exe 'C:\Users\user\Desktop\Setup.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i 'C:\Users\user\AppData\Local\Downloaded Installations\{877F9BE8-C6E2-462D-9A96-09E42390D002}\Star4Live_P2P.msi' SETUPEXEDIR='C:\Users\user\Desktop' SETUPEXENAME='Setup.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C31728C15F7B7E0360F95AF524D72042 C
Source: unknown	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9ADD54B1DEB9106D315583847C272BCA
Source: unknown	Process created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe
Source: unknown	Process created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe
Source: unknown	Process created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWindowPopup.exe C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWindowPopup.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\Setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe MSIEXEC.EXE /i 'C:\Users\user\AppData\Local\Downloaded Installations\{877F9BE8-C6E2-462D-9A96-09E42390D002}\Star4Live_P2P.msi' SETUPEXEDIR='C:\Users\user\Desktop' SETUPEXENAME='Setup.exe'			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWindowPopup.exe C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Uses an in-process (OLE) Automation server

Source: C:\Windows\SysWOW64\msiexec.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C103E-0000-0000-C000-000000000046}\InProcServer32

Jump to behavior

Writes ini files

Source: C:\Users\user\Desktop\Setup.exe

File written: C:\Users\user\AppData\Local\Temp\{429B5CB3-339E-483B-9032-CB0DA14F2F9A}\Setup.INI

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Install
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: OK

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Submission file is bigger than most known malware samples

Source: Setup.exe

Static file information: File size 9610518 > 1048576

Uses new MSVCR Dlls

Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9415_none_508df7e2bcbccb90\MSVCR90.dll

Jump to behavior

PE file contains a debug data directory

Source: Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: C:\CodeBases\isdev\src\Runtime\MSI\Shared\Setup\Setup___Win32_Release_Unicode\setup.pdb source: Setup.exe
Source:	Binary string: h:\nt.obj.x86fre\base\wcp\tools\msmcustomaction\objfre\i386\msmcustomaction.pdb source: Star4Live_P2P.msi0.0.dr

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0042C46B _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C46B

PE file contains an invalid checksum

Source: Setup.exe

Static PE information: real checksum: 0x12b0bb should be: 0x92c131

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_004481BD push 590001EBh; ret		0_2_004481C4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 2_2_07E4FAB6 push ds; retn 0000h		2_2_07E4FAB7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 2_2_0840F96E push ds; retn 0000h		2_2_0840F96F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 2_2_0840DDF8 push 00000078h; ret		2_2_0840DDFA

Persistence and Installation Behavior:

Drops PE files

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSI1304.tmp

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpServer.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (date check)

Source: C:\Users\user\Desktop\Setup.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWindowPopup.exe TID: 1540	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6628	Thread sleep time: -30000s >= -30000s			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Users\user\Desktop\Setup.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004221BF __EH_prolog3,_memset,GetTempPathW,FindFirstFileW,CompareFileTime,DeleteFileW,FindNextFileW,

0_2_004221BF

Contains functionality to query system information

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_004404D3 __EH_prolog3,VirtualQuery,GetSystemInfo,MapViewOfFile,

0_2_004404D3

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: svchost.exe, 00000001.00000002.208069130.00000213E0740000.00000002.00000001.sdmp, msiexec.exe, 00000002.00000002.257719427.0000000005D00000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.275587286.00000210AF660000.00000002.00000001.sdmp, svchost.exe, 0000001C.00000002.468740260.00000268B8F40000.00000002.00000001.sdmp, svchost.exe, 00000022.00000002.300275137.0000022A9D8B0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000019.00000002.470998272.0000029D7CA62000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000019.00000002.470937429.0000029D7CA55000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001B.00000002.466063169.0000016944E02000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000001.00000002.208069130.00000213E0740000.00000002.00000001.sdmp, msiexec.exe, 00000002.00000002.257719427.0000000005D00000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.275587286.00000210AF660000.00000002.00000001.sdmp, svchost.exe, 0000001C.00000002.468740260.00000268B8F40000.00000002.00000001.sdmp, svchost.exe, 00000022.00000002.300275137.0000022A9D8B0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000001.00000002.208069130.00000213E0740000.00000002.00000001.sdmp, msiexec.exe, 00000002.00000002.257719427.0000000005D00000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.275587286.00000210AF660000.00000002.00000001.sdmp, svchost.exe, 0000001C.00000002.468740260.00000268B8F40000.00000002.00000001.sdmp, svchost.exe, 00000022.00000002.300275137.0000022A9D8B0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000019.00000002.466353504.0000029D7B22A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW=
Source: svchost.exe, 0000001B.00000002.466189907.0000016944E28000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000002.466613856.00000268B8266000.00000004.00000001.sdmp, svchost.exe, 0000001E.00000002.466960401.0000022E5A629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000001.00000002.208069130.00000213E0740000.00000002.00000001.sdmp, msiexec.exe, 00000002.00000002.257719427.0000000005D00000.00000002.00000001.sdmp, svchost.exe, 0000001A.00000002.275587286.00000210AF660000.00000002.00000001.sdmp, svchost.exe, 0000001C.00000002.468740260.00000268B8F40000.00000002.00000001.sdmp, svchost.exe, 00000022.00000002.300275137.0000022A9D8B0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0042C46B _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C46B

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00409B54 GetFileSize,GetProcessHeap,GetProcessHeap,HeapAlloc,ReadFile,lstrlenA,__alloca_probe_16,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,ReadFile,GetProcessHeap,HeapFree,

0_2_00409B54

Enables debug privileges

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Program Files (x86)\Star4Live\Star4Live_P2P\CloudHttpWin32Server.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior

Uses taskkill to terminate processes

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpServer.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM CloudHttpWindowPopup.exe			Jump to behavior

Contains functionality to add an ACL to a security descriptor

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0043C9DC __EH_prolog3,_memset,_memset,_memset,_memset,_memset,_memset,InitializeSecurityDescriptor,GetModuleHandleW,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,CoInitializeSecurity,

0_2_0043C9DC

May try to detect the Windows Explorer process (often used for injection)

Source: svchost.exe, 0000001D.00000002.467186237.0000021752460000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Setup.exe, svchost.exe, 0000001D.00000002.467186237.0000021752460000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 0000001D.00000002.467186237.0000021752460000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Setup.exe	Binary or memory string: AShell_TrayWndTahoma0x0409NoSuppressRebootKeyDotNetOptionalInstallIfSilentDotNetOptionalSETUPEXENAMESETUPEXEDIRCertKeyCacheFolderCacheRootLocationTypeSuppressWrongOSSuppressReboot
Source: svchost.exe, 0000001D.00000002.467186237.0000021752460000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: Setup.exe	Binary or memory string: AShell_TrayWnd

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\Setup.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,		0_2_00480075
Source: C:\Users\user\Desktop\Setup.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,		0_2_0048000E
Source: C:\Users\user\Desktop\Setup.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,		0_2_004800B1

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_0042C46B _memset,_memset,lstrlenW,_memset,wsprintfW,___FUnloadDelayLoadedDLL2@4,LoadLibraryW,GetProcAddress,GetLastError,GetSystemTimeAsFileTime,

0_2_0042C46B

Contains functionality to query windows version

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00432AA2 GetVersionExW,GetSystemInfo,

0_2_00432AA2

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 00000021.00000002.466364627.000001CD8943D000.00000004.00000001.sdmp	Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 00000021.00000002.466429130.000001CD89502000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct