File name:

aksmon32_setup.exe

Full analysis: https://app.any.run/tasks/16748349-663d-45d6-994a-043d4eb75197
Verdict: Malicious activity
Analysis date: September 01, 2021, 21:10:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EC05CDD6657143B5217E76070996B150

SHA1:

79A4C04F17F90EF9A026745DF62500DE9E63C041

SHA256:

3D7AC6DCCB206ABE91679C7FB4F18701A524C50F6F7D6DF18E7381B40888077A

SSDEEP:

49152:Ep9FFpH7GQGnhoqGDp3ih+2wYa8wZYJFx:EXBiQGevp3e+2wYa8wZq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • aksmon32_setup.exe (PID: 520)
      • GLBAFC0.tmp (PID: 3140)

    • Application was dropped or rewritten from another process

      • GLBAFC0.tmp (PID: 3140)
      • aksmon.exe (PID: 3372)

    • Loads dropped or rewritten executable

      • GLBAFC0.tmp (PID: 3140)
      • aksmon.exe (PID: 3372)

  • SUSPICIOUS

    • Checks supported languages

      • aksmon32_setup.exe (PID: 520)
      • aksmon.exe (PID: 3372)
      • GLBAFC0.tmp (PID: 3140)

    • Drops a file with a compile date too recent

      • aksmon32_setup.exe (PID: 520)

    • Starts application with an unusual extension

      • aksmon32_setup.exe (PID: 520)

    • Executable content was dropped or overwritten

      • aksmon32_setup.exe (PID: 520)
      • GLBAFC0.tmp (PID: 3140)

    • Reads the computer name

      • GLBAFC0.tmp (PID: 3140)
      • aksmon.exe (PID: 3372)

    • Removes files from Windows directory

      • GLBAFC0.tmp (PID: 3140)

    • Creates files in the Windows directory

      • GLBAFC0.tmp (PID: 3140)

    • Drops a file with too old compile date

      • GLBAFC0.tmp (PID: 3140)

    • Creates a directory in Program Files

      • GLBAFC0.tmp (PID: 3140)

    • Creates a software uninstall entry

      • GLBAFC0.tmp (PID: 3140)

    • Creates files in the program directory

      • GLBAFC0.tmp (PID: 3140)

    • Drops a file that was compiled in debug mode

      • GLBAFC0.tmp (PID: 3140)

  • INFO

    • Manual execution by user

      • aksmon.exe (PID: 3372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

LegalCopyright: Aladdin Knowledge Systems Ltd,©1婍
FileVersion: 1.4.2
FileDescription: Aladdin Monitor
CompanyName: Aladdin Knowledge Systems Ltd.
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows 16-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.4.2.0
FileVersionNumber: 1.4.2.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1000
UninitializedDataSize: -
InitializedDataSize: 1807872
CodeSize: 512
LinkerVersion: 6
PEType: PE32
TimeStamp: 1999:04:08 22:24:47+02:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start aksmon32_setup.exe glbafc0.tmp aksmon.exe aksmon32_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
520"C:\Users\admin\AppData\Local\Temp\aksmon32_setup.exe" C:\Users\admin\AppData\Local\Temp\aksmon32_setup.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\aksmon32_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
3140C:\Users\admin\AppData\Local\Temp\GLBAFC0.tmp 4736 C:\Users\admin\AppData\Local\Temp\AKSMON~1.EXEC:\Users\admin\AppData\Local\Temp\GLBAFC0.tmp
aksmon32_setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\glbafc0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3372"C:\Program Files\Aladdin\Monitor\aksmon.exe" C:\Program Files\Aladdin\Monitor\aksmon.exe
Explorer.EXE
User:
admin
Company:
Aladdin Knowledge Systems Ltd.
Integrity Level:
MEDIUM
Description:
Aladdin Monitor
Exit code:
0
Version:
1, 4, 2, 0
Modules
Images
c:\program files\aladdin\monitor\aksmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\aladdin\monitor\nhlminst.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
3520"C:\Users\admin\AppData\Local\Temp\aksmon32_setup.exe" C:\Users\admin\AppData\Local\Temp\aksmon32_setup.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\aksmon32_setup.exe
c:\windows\system32\ntdll.dll
Total events
530
Read events
528
Write events
2
Delete events
0

Modification events

(PID) Process:(3140) GLBAFC0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Aladdin Monitor 1.4.2
Operation:writeName:DisplayName
Value:
Aladdin Monitor 1.4.2
(PID) Process:(3140) GLBAFC0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Aladdin Monitor 1.4.2
Operation:writeName:UninstallString
Value:
C:\PROGRA~1\Aladdin\Monitor\UNWISE.EXE C:\PROGRA~1\Aladdin\Monitor\INSTALL.LOG
Executable files
23
Suspicious files
0
Text files
8
Unknown types
6

Dropped files

PID
Process
Filename
Type
520aksmon32_setup.exeC:\Users\admin\AppData\Local\Temp\GLBAFC0.tmpexecutable
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Users\admin\AppData\Local\Temp\~GLH0001.TMPtext
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\~GLH0004.TMPtext
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Users\admin\AppData\Local\Temp\GLFBBBC.tmptext
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\nethasp.initext
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\~GLH0005.TMPexecutable
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\nhlminst.dllexecutable
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\~GLH0006.TMPexecutable
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\aksmon_en.hlphlp
MD5:—
SHA256:—
3140GLBAFC0.tmpC:\Program Files\Aladdin\Monitor\~GLH0007.TMPhlp
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
aksmon32_setup.exe