File name:

NoteBookFanControl.1.6.3.setup.exe

Full analysis: https://app.any.run/tasks/cd586eaa-f601-4401-a506-6e6c6bc23776
Verdict: Malicious activity
Analysis date: March 13, 2024, 08:50:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

26D498CF3627DA3A1D59A890CF76098D

SHA1:

0EF4AA5A6478BEC192E1F9470F28AD7F76B554D9

SHA256:

5A42531F3A051DBD9664B1FF41A6CDBFBB34BC71A91DB719B8FE94829594EBAA

SSDEEP:

98304:e9qY/llfA1SdzdVEZV3Mob1qT7GDz1YQBZm2Vt5DbNnKxjeuqXRNzl6HDAPV95da:R9r2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Changes the autorun value in the registry

      • NoteBookFanControl.setup.exe (PID: 3932)

  • SUSPICIOUS

    • Starts itself from another location

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)

    • Executable content was dropped or overwritten

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Searches for installed software

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Reads security settings of Internet Explorer

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)

    • Reads the Internet Settings

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.exe (PID: 2360)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2340)
      • NbfcService.exe (PID: 2888)

    • Creates a software uninstall entry

      • NoteBookFanControl.setup.exe (PID: 3932)

  • INFO

    • Create files in a temporary directory

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Checks supported languages

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Reads the computer name

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Reads the machine GUID from the registry

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)

    • Creates files in the program directory

      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)

    • Manual execution by a user

      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Creates files or folders in the user directory

      • NoteBookFanControl.exe (PID: 2360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:05:01 14:33:52+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.1
CodeSize: 302080
InitializedDataSize: 337408
UninitializedDataSize: -
EntryPoint: 0x2e1fd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.6.3.0
ProductVersionNumber: 1.6.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Stefan Hirschmann - StagWare
FileDescription: NoteBook FanControl
FileVersion: 1.6.3.0
InternalName: setup
LegalCopyright: Copyright (c) Stefan Hirschmann - StagWare. All rights reserved.
OriginalFileName: NoteBookFanControl.setup.exe
ProductName: NoteBook FanControl
ProductVersion: 1.6.3.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notebookfancontrol.1.6.3.setup.exe notebookfancontrol.1.6.3.setup.exe notebookfancontrol.setup.exe vssvc.exe no specs nbfcservice.exe no specs notebookfancontrol.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1740"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2340C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2360"C:\Program Files\NoteBook FanControl\NoteBookFanControl.exe" C:\Program Files\NoteBook FanControl\NoteBookFanControl.exe—explorer.exe
User:
admin
Company:
StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl Client
Exit code:
0
Version:
1.6.3
Modules
Images
c:\program files\notebook fancontrol\notebookfancontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2888"C:\Program Files\NoteBook FanControl\NbfcService.exe"C:\Program Files\NoteBook FanControl\NbfcService.exe—services.exe
User:
SYSTEM
Company:
StagWare
Integrity Level:
SYSTEM
Description:
NoteBook FanControl Service
Exit code:
0
Version:
1.6.3
Modules
Images
c:\program files\notebook fancontrol\nbfcservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3536"C:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exe
NoteBookFanControl.1.6.3.setup.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\{319bfd16-ff6c-466a-a212-8eca2b936a84}\.cr\notebookfancontrol.1.6.3.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3656"C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe" C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe
explorer.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\notebookfancontrol.1.6.3.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3932"C:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.be\NoteBookFanControl.setup.exe" -q -burn.elevated BurnPipe.{C63352EE-A549-464C-81F0-664D6362F961} {56EAF7C2-F3FB-4CF5-93F9-7F4816E86988} 3536C:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.be\NoteBookFanControl.setup.exe
NoteBookFanControl.1.6.3.setup.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
HIGH
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\{979515dc-0f27-4c26-99b6-3ed2b66cbf73}\.be\notebookfancontrol.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 148
Read events
6 962
Write events
180
Delete events
6

Modification events

(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000CA93E8942375DA015C0F0000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000CA93E8942375DA015C0F0000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000F408FE942375DA015C0F0000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000001E7E13952375DA015C0F00002C070000E80300000100000000000000000000003FEB809975478947BE04C7D56DF4C0DF0000000000000000
(PID) Process:(2340) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000E0691F952375DA0124090000980F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
7
Suspicious files
3
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3932NoteBookFanControl.setup.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\logoside.pngimage
MD5:80196B60CD7E7D86D341BC9D29972BAA
SHA256:9827A95DCE2379D4539B582F3053ACE46F617B2CE4D61C06EE78B8C717613B4C
3656NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exeexecutable
MD5:ECB20590D6FE6FEC49507F7295477560
SHA256:55E0EFADB9B0B2657505EE566B3615B661B6F4EDA1946944F1D323E0DC34F0BA
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\logo.pngimage
MD5:497FDCA26DAD9315D1BCDA11AF7E0E72
SHA256:C65AF4D67BC79D9D3CAF18DD5C720CB86E2E978668748828E5551C8105CB5B4C
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\BootstrapperApplicationData.xmlxml
MD5:087C34CB41434B47C73F0916C4E436A8
SHA256:5B98BFE5F1C4D4F2E891631D7FA2BE5CFFB8CFFF15227512B3D6A5CC55F733A3
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.be\NoteBookFanControl.setup.exeexecutable
MD5:ECB20590D6FE6FEC49507F7295477560
SHA256:55E0EFADB9B0B2657505EE566B3615B661B6F4EDA1946944F1D323E0DC34F0BA
3932NoteBookFanControl.setup.exeC:\ProgramData\Package Cache\{6ccab7ac-feb0-4395-97e3-75cd6f6c407b}\NoteBookFanControl.setup.exeexecutable
MD5:ECB20590D6FE6FEC49507F7295477560
SHA256:55E0EFADB9B0B2657505EE566B3615B661B6F4EDA1946944F1D323E0DC34F0BA
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\thm.xmlxml
MD5:085EBE810174349031E110AFF30C3308
SHA256:D651717792B3CAE6823F9B6846339C34B05E78D1C022350096A29E0EF7597D04
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\thm.wxlxml
MD5:A501B43EB5C917C4967BD521822D4298
SHA256:8049ACA29C47AAA5D6D25F939598F43D86E4F6760CD9E3E5F9FF57CB12CD0A85
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\wixstdba.dllexecutable
MD5:6BA2E331E0F447AAFF0E8142DF5F7230
SHA256:58A135101A2044D96F470E29369A8214C5C2ADD774488D73C6AE81A588582239
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NoteBookFanControl.1.6.3.setup.exe