File name:

nexigo_setup_v02.exe

Full analysis: https://app.any.run/tasks/105d16a4-74ac-4e9d-94c6-043868c00e80
Verdict: Malicious activity
Analysis date: December 05, 2023, 22:03:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

225B32359161E983DDBF689ADB3139F7

SHA1:

2534C8360A361C0DB96E47FD70A8593DE672EA37

SHA256:

43E0605E021FF7666F6D7C3A486386545844DEFF8AED2266FFDAD82F08DF2328

SSDEEP:

24576:R4nXubIQGyxbPV0db26fpaHKgh9dhv6F5r4MCSRdTkp+Fg5Fktcx1pi4Vx3X6nVb:Rqe3f6tpKdhioxSRdTmy4FQqh5wyC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • nexigo_setup_v02.exe (PID: 1236)
      • nexigo_setup_v02.exe (PID: 280)
      • nexigo_setup_v02.tmp (PID: 2464)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • nexigo_setup_v02.tmp (PID: 2464)

    • Process drops legitimate windows executable

      • nexigo_setup_v02.tmp (PID: 2464)

    • Reads the Internet Settings

      • NexiGo.exe (PID: 1116)

  • INFO

    • Checks supported languages

      • nexigo_setup_v02.exe (PID: 1236)
      • nexigo_setup_v02.exe (PID: 280)
      • nexigo_setup_v02.tmp (PID: 3980)
      • nexigo_setup_v02.tmp (PID: 2464)
      • NexiGo.exe (PID: 1116)
      • wmpnscfg.exe (PID: 2336)

    • Create files in a temporary directory

      • nexigo_setup_v02.exe (PID: 1236)
      • nexigo_setup_v02.exe (PID: 280)

    • Reads the computer name

      • nexigo_setup_v02.tmp (PID: 3980)
      • nexigo_setup_v02.tmp (PID: 2464)
      • NexiGo.exe (PID: 1116)
      • wmpnscfg.exe (PID: 2336)

    • Creates files in the program directory

      • nexigo_setup_v02.tmp (PID: 2464)

    • Creates files or folders in the user directory

      • NexiGo.exe (PID: 1116)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2336)

    • Reads the machine GUID from the registry

      • NexiGo.exe (PID: 1116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 10:48:30+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 43008
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Nexight Inc
FileDescription: NexiGo Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: NexiGo
ProductVersion: 1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start nexigo_setup_v02.exe no specs nexigo_setup_v02.tmp no specs nexigo_setup_v02.exe nexigo_setup_v02.tmp no specs nexigo.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe" /SPAWNWND=$1601F0 /NOTIFYWND=$25013A C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe
nexigo_setup_v02.tmp
User:
admin
Company:
Nexight Inc
Integrity Level:
HIGH
Description:
NexiGo Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\nexigo_setup_v02.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1116"C:\Program Files\NexiGo\NexiGo.exe"C:\Program Files\NexiGo\NexiGo.exe—nexigo_setup_v02.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
CamCtl
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\nexigo\nexigo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1236"C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe" C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe—explorer.exe
User:
admin
Company:
Nexight Inc
Integrity Level:
MEDIUM
Description:
NexiGo Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\nexigo_setup_v02.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2336"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2464"C:\Users\admin\AppData\Local\Temp\is-OVO5S.tmp\nexigo_setup_v02.tmp" /SL5="$1B0190,1188420,785408,C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe" /SPAWNWND=$1601F0 /NOTIFYWND=$25013A C:\Users\admin\AppData\Local\Temp\is-OVO5S.tmp\nexigo_setup_v02.tmp—nexigo_setup_v02.exe
User:
admin
Company:
Nexight Inc
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ovo5s.tmp\nexigo_setup_v02.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3980"C:\Users\admin\AppData\Local\Temp\is-8U65J.tmp\nexigo_setup_v02.tmp" /SL5="$25013A,1188420,785408,C:\Users\admin\AppData\Local\Temp\nexigo_setup_v02.exe" C:\Users\admin\AppData\Local\Temp\is-8U65J.tmp\nexigo_setup_v02.tmp—nexigo_setup_v02.exe
User:
admin
Company:
Nexight Inc
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8u65j.tmp\nexigo_setup_v02.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 234
Read events
1 220
Write events
8
Delete events
6

Modification events

(PID) Process:(1116) NexiGo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1116) NexiGo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1116) NexiGo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1116) NexiGo.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFilesHash
Value:
65957CB0218FFFB1D61A9DC0489CB6E9F4A5FCE681A40CBAD60494E9E34C0228
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFiles0000
Value:
C:\Program Files\NexiGo\NexiGo.exe
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
C043006F78313450A3D832F665CA0601EC0EAC5CA549B838853AB7681E018988
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
A00900002E2EC5DCC627DA01
(PID) Process:(2464) nexigo_setup_v02.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:delete keyName:(default)
Value:
Executable files
24
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1236nexigo_setup_v02.exeC:\Users\admin\AppData\Local\Temp\is-8U65J.tmp\nexigo_setup_v02.tmpexecutable
MD5:BE3BF07A5E4E55832EAA062B34A017BF
SHA256:5551B46D2B1ADBC179F72CF80C86D4D651E50596A0B6724685EBBC87480EE7EA
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\is-3A1MU.tmpexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\unins000.exeexecutable
MD5:94AE30B18028C00336C995F9FF78F219
SHA256:B6847497DB3CFC3A91A46AB95C925EA4389C0DA95F4B2B4B013E08E3270E5077
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\AForge.Video.dllexecutable
MD5:0BD34AA29C7EA4181900797395A6DA78
SHA256:BAFA6ED04CA2782270074127A0498DDE022C2A9F4096C6BB2B8E3C08BB3D404D
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\is-H8BJE.tmpexecutable
MD5:0BD34AA29C7EA4181900797395A6DA78
SHA256:BAFA6ED04CA2782270074127A0498DDE022C2A9F4096C6BB2B8E3C08BB3D404D
280nexigo_setup_v02.exeC:\Users\admin\AppData\Local\Temp\is-OVO5S.tmp\nexigo_setup_v02.tmpexecutable
MD5:BE3BF07A5E4E55832EAA062B34A017BF
SHA256:5551B46D2B1ADBC179F72CF80C86D4D651E50596A0B6724685EBBC87480EE7EA
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\Newtonsoft.Json.dllexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\is-BN7HQ.tmpexecutable
MD5:02C63F568E598AAD85DD401D7B26E82A
SHA256:966A474060A8ACA70C73BA09D0B6FE2353035961C7107B9003EF879C010FF8DA
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\is-MI2QC.tmpexecutable
MD5:0AF7E403D777236C6C2047EE59719A64
SHA256:DFAEAAB0791A2A07016EBD224F5819F24C54F31D56DE8D41CF01118915BD9BF5
2464nexigo_setup_v02.tmpC:\Program Files\NexiGo\AForge.dllexecutable
MD5:02C63F568E598AAD85DD401D7B26E82A
SHA256:966A474060A8ACA70C73BA09D0B6FE2353035961C7107B9003EF879C010FF8DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
868
svchost.exe
23.35.228.137:80
—
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
88.221.124.138:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 88.221.124.138
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nexigo_setup_v02.exe