Setup.exe

Windows Installation and Setup file version info

Program on Windows LOLRMM VIZOR 19 known copies with hashes 9 Sigma rules name it

A file of VIZOR

a remote management tool, from LOLRMM

LOLRMM lists a file named Setup.exe as VIZOR’s. VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud).

Its sitehttps://www.vector-networks.com/

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily VIZOR’s.

Is it the real Setup.exe?

file version info and known copies

Installed inC:\Windows\system32\oobe\
C:\ProgramData\Adobe\Setup\{00000000-0000-0000-0000-000000000000}\
C:\Windows\SysWOW64\InstallShield\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Installation and Setup

19 known copies

95.0.1020.40 · C:\Program Files (x86)\Microsoft\Edge\Application\95.0.1020.40\Installer\setup.exe · signed by Microsoft Corporation

dac519816b2ac00fe7d8832f2748a4f81b878af884146b3855110a96766d8a83

85.0.564.68 · C:\Program Files (x86)\Microsoft\Edge\Application\85.0.564.68\Installer\setup.exe · signed by Microsoft Corporation

411045634dc636766c66e605a0444f14e71b3b18fe3936fa8ce67649a6fbd860

5, 54, 001, 0 · C:\Windows\SysWOW64\InstallShield\setup.exe · signed by Microsoft Windows

3f14c822bd440fec8458fd11e950315e3d784908629b301526a57a3a623bf70c

20.9.20063.381938 · C:\ProgramData\Adobe\Setup\{00000000-0000-0000-0000-000000000000}\RDC\setup.exe · signed by Adobe Inc.

4b76c0ea832d58966f824cfedb9a3831b1c286b13cc22d56e29dad7966847184

15.9.20069.159242 · C:\ProgramData\Adobe\Setup\{00000000-0000-0000-0000-000000000000}\setup.exe · signed by Adobe Systems

2cc96093d90228ab6f74ad1737e5b5af92ad60f934efc4a0d9b665ef8a7b40ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

0218fe40a463e76c362371e303665b11682fa818767170650b2817b32d32b292

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

0258acede495ff87e674ac4e5bcad8924bcdb31d954c6dc2863e5c66eab38172

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\oobe\Setup.exe · signed by Microsoft Corporation

47f3be4fbdc620088d26d3cc5bbef6bab0e84d60d7bbc7936d40d56340df1638

5, 54, 001, 0 · C:\Windows\SysWOW64\InstallShield\setup.exe · signed by Microsoft Windows

5d5cc12f985b30a43d79fa8d44eb6cb0caddb47d2d33ec28fbc8416cfb7514db

18.11.0 · C:\WINDOWS\system32\DriverStore\FileRepository\netwew01.inf_amd64_d48428047ce3cc1e\Setup.exe · signed by Microsoft Windows Hardware Compatibility Publisher

a201756b24c7872f42ff71008b28da0b10d0963e33f84395411125a27fd9c0dd

11.0.04.63 · C:\ProgramData\Adobe\Setup\{00000000-0000-0000-0000-000000000000}\setup.exe · signed by Adobe Systems

d586146af811bc24091b712100ac092e0ead79a5a6340aeb574bb9c239d8f4d4

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\Setup.exe · signed by Microsoft Windows

812430543fda6aa29af657e46cd86e2aa19f41caf1261180ffaa0b4db3da4215

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

613297bef72a44d76dd51a2c10131b6f6fefa3b62ba20d93e8c483718559ab42

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

7148fd863089886be84d9066b2f6643d779ae09cc6643e413014d2aa8a574932

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

fb2cc6a3e02e538714d1634ca7889c5a3f214c32ffaa0ea21fcc90fd64ffceb4

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\oobe\Setup.exe · signed by Microsoft Windows

f75e7f6080f1d2734dc15d46b530187790e277e5af88e5e7d123686e90ee32bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

5ed119f1aff65f89b4a0368fdb005e589152b3e08a64a0cbb7b082a02015e63f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\oobe\Setup.exe · signed by Microsoft Windows

6600eeff725da15cd3c7d5d10e1f1aba79fefe47f4d3ca490e36a45249dc0b23

2.0.40.0 · C:\ProgramData\Intel\Package Cache\{00000000-0000-0000-0000-000000000000}\Setup.exe · not signed

4979a84f0b21ed50e2456aa5f6c90583b474b11abc17fe5cef6bf322b87171b2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Setup.exe

criticalWinnti Pipemon CharacteristicsFlorian Roth (Nextron Systems), oscd.community

highBad Opsec Defaults Sacrificial Processes With Improper ArgumentsOleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)

highPotentially Suspicious GoogleUpdate Child ProcessNasreddine Bencherchali (Nextron Systems)

mediumRundll32 Execution With Uncommon DLL ExtensionTim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou

Sigma names Setup.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.