File name:

NoteBookFanControl.1.6.3.setup.exe

Full analysis: https://app.any.run/tasks/cd586eaa-f601-4401-a506-6e6c6bc23776
Verdict: Malicious activity
Analysis date: March 13, 2024, 08:50:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

26D498CF3627DA3A1D59A890CF76098D

SHA1:

0EF4AA5A6478BEC192E1F9470F28AD7F76B554D9

SHA256:

5A42531F3A051DBD9664B1FF41A6CDBFBB34BC71A91DB719B8FE94829594EBAA

SSDEEP:

98304:e9qY/llfA1SdzdVEZV3Mob1qT7GDz1YQBZm2Vt5DbNnKxjeuqXRNzl6HDAPV95da:R9r2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Changes the autorun value in the registry

      • NoteBookFanControl.setup.exe (PID: 3932)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Starts itself from another location

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)

    • Searches for installed software

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Reads security settings of Internet Explorer

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)

    • Reads the Internet Settings

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.exe (PID: 2360)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2340)
      • NbfcService.exe (PID: 2888)

    • Creates a software uninstall entry

      • NoteBookFanControl.setup.exe (PID: 3932)

  • INFO

    • Checks supported languages

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Create files in a temporary directory

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3656)
      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)

    • Reads the computer name

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Reads the machine GUID from the registry

      • NoteBookFanControl.1.6.3.setup.exe (PID: 3536)
      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)
      • NoteBookFanControl.exe (PID: 2360)

    • Creates files in the program directory

      • NoteBookFanControl.setup.exe (PID: 3932)
      • NbfcService.exe (PID: 2888)

    • Manual execution by a user

      • NoteBookFanControl.exe (PID: 2360)
      • wmpnscfg.exe (PID: 1740)

    • Creates files or folders in the user directory

      • NoteBookFanControl.exe (PID: 2360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:05:01 14:33:52+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.1
CodeSize: 302080
InitializedDataSize: 337408
UninitializedDataSize: -
EntryPoint: 0x2e1fd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.6.3.0
ProductVersionNumber: 1.6.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Stefan Hirschmann - StagWare
FileDescription: NoteBook FanControl
FileVersion: 1.6.3.0
InternalName: setup
LegalCopyright: Copyright (c) Stefan Hirschmann - StagWare. All rights reserved.
OriginalFileName: NoteBookFanControl.setup.exe
ProductName: NoteBook FanControl
ProductVersion: 1.6.3.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start notebookfancontrol.1.6.3.setup.exe notebookfancontrol.1.6.3.setup.exe notebookfancontrol.setup.exe vssvc.exe no specs nbfcservice.exe no specs notebookfancontrol.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1740"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2340C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2360"C:\Program Files\NoteBook FanControl\NoteBookFanControl.exe" C:\Program Files\NoteBook FanControl\NoteBookFanControl.exe—explorer.exe
User:
admin
Company:
StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl Client
Exit code:
0
Version:
1.6.3
Modules
Images
c:\program files\notebook fancontrol\notebookfancontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2888"C:\Program Files\NoteBook FanControl\NbfcService.exe"C:\Program Files\NoteBook FanControl\NbfcService.exe—services.exe
User:
SYSTEM
Company:
StagWare
Integrity Level:
SYSTEM
Description:
NoteBook FanControl Service
Exit code:
0
Version:
1.6.3
Modules
Images
c:\program files\notebook fancontrol\nbfcservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3536"C:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exe
NoteBookFanControl.1.6.3.setup.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\{319bfd16-ff6c-466a-a212-8eca2b936a84}\.cr\notebookfancontrol.1.6.3.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3656"C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe" C:\Users\admin\AppData\Local\Temp\NoteBookFanControl.1.6.3.setup.exe
explorer.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
MEDIUM
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\notebookfancontrol.1.6.3.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3932"C:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.be\NoteBookFanControl.setup.exe" -q -burn.elevated BurnPipe.{C63352EE-A549-464C-81F0-664D6362F961} {56EAF7C2-F3FB-4CF5-93F9-7F4816E86988} 3536C:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.be\NoteBookFanControl.setup.exe
NoteBookFanControl.1.6.3.setup.exe
User:
admin
Company:
Stefan Hirschmann - StagWare
Integrity Level:
HIGH
Description:
NoteBook FanControl
Exit code:
0
Version:
1.6.3.0
Modules
Images
c:\users\admin\appdata\local\temp\{979515dc-0f27-4c26-99b6-3ed2b66cbf73}\.be\notebookfancontrol.setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 148
Read events
6 962
Write events
180
Delete events
6

Modification events

(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3536) NoteBookFanControl.1.6.3.setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000CA93E8942375DA015C0F0000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000CA93E8942375DA015C0F0000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000F408FE942375DA015C0F0000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3932) NoteBookFanControl.setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000001E7E13952375DA015C0F00002C070000E80300000100000000000000000000003FEB809975478947BE04C7D56DF4C0DF0000000000000000
(PID) Process:(2340) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000E0691F952375DA0124090000980F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
7
Suspicious files
3
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3932NoteBookFanControl.setup.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3656NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{319BFD16-FF6C-466A-A212-8ECA2B936A84}\.cr\NoteBookFanControl.1.6.3.setup.exeexecutable
MD5:ECB20590D6FE6FEC49507F7295477560
SHA256:55E0EFADB9B0B2657505EE566B3615B661B6F4EDA1946944F1D323E0DC34F0BA
3932NoteBookFanControl.setup.exeC:\ProgramData\Package Cache\{6ccab7ac-feb0-4395-97e3-75cd6f6c407b}\NoteBookFanControl.setup.exeexecutable
MD5:ECB20590D6FE6FEC49507F7295477560
SHA256:55E0EFADB9B0B2657505EE566B3615B661B6F4EDA1946944F1D323E0DC34F0BA
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\thm.wxlxml
MD5:A501B43EB5C917C4967BD521822D4298
SHA256:8049ACA29C47AAA5D6D25F939598F43D86E4F6760CD9E3E5F9FF57CB12CD0A85
3932NoteBookFanControl.setup.exeC:\ProgramData\Package Cache\{6ccab7ac-feb0-4395-97e3-75cd6f6c407b}\state.rsmsmt
MD5:E7DD4BA5F2426DC5A0AFD6986D6828E8
SHA256:3D55190ABEFC24530EEAA53C5F9A7B321CC9FB2A010BFACB3DDA0800E4EF77A6
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\BootstrapperApplicationData.xmlxml
MD5:087C34CB41434B47C73F0916C4E436A8
SHA256:5B98BFE5F1C4D4F2E891631D7FA2BE5CFFB8CFFF15227512B3D6A5CC55F733A3
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\.ba\logoside.pngimage
MD5:80196B60CD7E7D86D341BC9D29972BAA
SHA256:9827A95DCE2379D4539B582F3053ACE46F617B2CE4D61C06EE78B8C717613B4C
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\NoteBook_FanControl_20240313085047.logtext
MD5:6690ABE665BE05B077AA8B205A2A991F
SHA256:62BD1CD1E0D790ECF3580A43768A0AA9354EE845C4FCE0ED896ACAD83B461C08
3932NoteBookFanControl.setup.exeC:\ProgramData\Package Cache\{C027E819-C64C-443E-B6D5-755FE4A7A925}v1.6.3.0\NbfcSetup.msiexecutable
MD5:604D97B5133CE5D5685E1DF3C1FFFB52
SHA256:E680718CAE221CF72DC9E8244A3FFD7C863D3510804BBAF33B1DB81EF835F660
3536NoteBookFanControl.1.6.3.setup.exeC:\Users\admin\AppData\Local\Temp\{979515DC-0F27-4C26-99B6-3ED2B66CBF73}\MsiPackageexecutable
MD5:604D97B5133CE5D5685E1DF3C1FFFB52
SHA256:E680718CAE221CF72DC9E8244A3FFD7C863D3510804BBAF33B1DB81EF835F660
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NoteBookFanControl.1.6.3.setup.exe