File name:

netscan_setup.exe

Full analysis: https://app.any.run/tasks/dff555fc-fa1a-4389-96ad-42e480943688
Verdict: Malicious activity
Analysis date: December 05, 2024, 15:06:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

8CBC0B8612D36EB98720ABF288419B5B

SHA1:

C6C8A7D0CDAA6B57E7041267A5B648AFFD36350C

SHA256:

301FA7B7029CDA829914AC474677B4C0D9CAACDF440022DD8C83F7B5E8538E20

SSDEEP:

98304:5rq3Bdw3U4/vZ/G4KvUSD5Ijd8gl1jwLXUGVPCdfthKPcq5u8SGV8Qk/kfU4HQcA:wjJ7iS6ebKstC+8cMP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • netscan_setup.exe (PID: 1020)
      • netscan_setup.exe (PID: 2160)
      • netscan.exe (PID: 5780)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • netscan_setup.tmp (PID: 556)

    • Executable content was dropped or overwritten

      • netscan_setup.exe (PID: 1020)
      • netscan_setup.exe (PID: 2160)
      • netscan_setup.tmp (PID: 3792)

    • Reads the Windows owner or organization settings

      • netscan_setup.tmp (PID: 3792)

    • There is functionality for communication over UDP network (YARA)

      • netscan.exe (PID: 5780)

  • INFO

    • Checks supported languages

      • netscan_setup.exe (PID: 1020)
      • netscan_setup.tmp (PID: 556)
      • netscan_setup.exe (PID: 2160)
      • netscan_setup.tmp (PID: 3792)

    • Reads the computer name

      • netscan_setup.tmp (PID: 556)
      • netscan_setup.exe (PID: 2160)
      • netscan_setup.tmp (PID: 3792)

    • Create files in a temporary directory

      • netscan_setup.exe (PID: 1020)
      • netscan_setup.exe (PID: 2160)
      • netscan_setup.tmp (PID: 3792)

    • Process checks computer location settings

      • netscan_setup.tmp (PID: 556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 8.2.3.0
ProductVersionNumber: 8.2.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: SoftPerfect Pty Ltd
FileDescription: SoftPerfect Network Scanner
FileVersion: 8.2.3
LegalCopyright: 2003-2024 SoftPerfect Pty Ltd
OriginalFileName:
ProductName: SoftPerfect Network Scanner
ProductVersion: 8.2.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
5
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start netscan_setup.exe netscan_setup.tmp no specs netscan_setup.exe netscan_setup.tmp netscan.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\is-MFHAA.tmp\netscan_setup.tmp" /SL5="$6028C,12137645,845824,C:\Users\admin\AppData\Local\Temp\netscan_setup.exe" C:\Users\admin\AppData\Local\Temp\is-MFHAA.tmp\netscan_setup.tmp—netscan_setup.exe
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-mfhaa.tmp\netscan_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1020"C:\Users\admin\AppData\Local\Temp\netscan_setup.exe" C:\Users\admin\AppData\Local\Temp\netscan_setup.exe
explorer.exe
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
MEDIUM
Description:
SoftPerfect Network Scanner
Exit code:
0
Version:
8.2.3
Modules
Images
c:\users\admin\appdata\local\temp\netscan_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2160"C:\Users\admin\AppData\Local\Temp\netscan_setup.exe" /SPAWNWND=$602A6 /NOTIFYWND=$6028C C:\Users\admin\AppData\Local\Temp\netscan_setup.exe
netscan_setup.tmp
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
HIGH
Description:
SoftPerfect Network Scanner
Exit code:
0
Version:
8.2.3
Modules
Images
c:\users\admin\appdata\local\temp\netscan_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
3792"C:\Users\admin\AppData\Local\Temp\is-0SG9H.tmp\netscan_setup.tmp" /SL5="$802AA,12137645,845824,C:\Users\admin\AppData\Local\Temp\netscan_setup.exe" /SPAWNWND=$602A6 /NOTIFYWND=$6028C C:\Users\admin\AppData\Local\Temp\is-0SG9H.tmp\netscan_setup.tmp
netscan_setup.exe
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-0sg9h.tmp\netscan_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5780"C:\Program Files\SoftPerfect Network Scanner\netscan.exe"C:\Program Files\SoftPerfect Network Scanner\netscan.exe—netscan_setup.tmp
User:
admin
Company:
SoftPerfect Pty Ltd
Integrity Level:
MEDIUM
Description:
Application for scanning networks
Version:
8.2.3.0
Modules
Images
c:\program files\softperfect network scanner\netscan.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
714
Read events
689
Write events
25
Delete events
0

Modification events

(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.3
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\SoftPerfect Network Scanner
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\SoftPerfect Network Scanner\
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
SoftPerfect Network Scanner
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:DisplayName
Value:
SoftPerfect Network Scanner version 8.2.3
(PID) Process:(3792) netscan_setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8083C3D9-F400-48FA-B060-CF55F25E2D4B}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SoftPerfect Network Scanner\netscan.exe
Executable files
11
Suspicious files
6
Text files
680
Unknown types
0

Dropped files

PID
Process
Filename
Type
2160netscan_setup.exeC:\Users\admin\AppData\Local\Temp\is-0SG9H.tmp\netscan_setup.tmpexecutable
MD5:044917C7D5996511B2E4112EB46316F8
SHA256:A798A3CBF70688A794109457B52F37445F0ED71B976C248897121B3D7605C61A
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\ADSL-LINE-EXT-MIBtext
MD5:62317CE9EFF85065D1828F8BFD8B8165
SHA256:38227DA168C76CC0B23730A33F4C90698CCE1F3A2E2FB6C8AFACE396AC8CC564
1020netscan_setup.exeC:\Users\admin\AppData\Local\Temp\is-MFHAA.tmp\netscan_setup.tmpexecutable
MD5:044917C7D5996511B2E4112EB46316F8
SHA256:A798A3CBF70688A794109457B52F37445F0ED71B976C248897121B3D7605C61A
3792netscan_setup.tmpC:\Program Files\SoftPerfect Network Scanner\unins000.exeexecutable
MD5:513F62708A09ABABE13FCFD94CA6C28E
SHA256:F57C6495A3010F789C3650CE1DD18968862E64BABD013275D70142AFB6D04110
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\ACCOUNTING-CONTROL-MIBtext
MD5:B3D5843D270546D9D304BA2F5BA03DE4
SHA256:2E476CE697C592E4F39A0E43EB51E4EBD8977C41D7FDA287C9DE7B98CFA6F1CA
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\ACCESSBIND-PIBtext
MD5:0F5E93840F554BC192069F9D556B98B9
SHA256:D45B578B3A21E40AA165C58CDA8A86E402B1C9556FF461D4F22A185EDA74A81A
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\is-DN1D4.tmptext
MD5:0F5E93840F554BC192069F9D556B98B9
SHA256:D45B578B3A21E40AA165C58CDA8A86E402B1C9556FF461D4F22A185EDA74A81A
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\is-OLV6G.tmptext
MD5:B3D5843D270546D9D304BA2F5BA03DE4
SHA256:2E476CE697C592E4F39A0E43EB51E4EBD8977C41D7FDA287C9DE7B98CFA6F1CA
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\is-MBQN3.tmptext
MD5:62317CE9EFF85065D1828F8BFD8B8165
SHA256:38227DA168C76CC0B23730A33F4C90698CCE1F3A2E2FB6C8AFACE396AC8CC564
3792netscan_setup.tmpC:\Users\admin\AppData\Roaming\SoftPerfect Network Scanner\Mibs\is-E0P1N.tmptext
MD5:3BCBD550C01F34F323BED1E4EA7083BD
SHA256:84E202C003BFB45B14212F3880DD4FF6E7CF1825E8935A08086F144155EF1202
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2096
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2096
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4196
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.137:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 104.126.37.137
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.131
  • 104.126.37.144
  • 104.126.37.154
  • 104.126.37.153
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
netscan_setup.exe