File name:

WavePadAudioEditingSoftware.exe

Full analysis: https://app.any.run/tasks/eed6cc2c-6a96-4d26-bceb-454b2ed008bc
Verdict: Malicious activity
Analysis date: March 14, 2024, 09:46:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DFAE5190306A755668CA07949F1DBD59

SHA1:

7FE59EABB62FA81DF40D51CCF82A3C22DCE50214

SHA256:

6DAF28E5975B862F816C2D47D553790DE5E113345EF501B4DF90089895147C89

SSDEEP:

98304:IlWUf6we6ofe60BBfqGUivA3imGxxXku56eDczRVUHcX1upgzdjAATGr9UgPTCYO:+BCfhv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Changes the autorun value in the registry

      • nchsetup.exe (PID: 3304)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Reads security settings of Internet Explorer

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)

    • Reads the Internet Settings

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)

    • Searches for installed software

      • nchsetup.exe (PID: 3304)

    • Starts itself from another location

      • nchsetup.exe (PID: 3304)

    • Creates a software uninstall entry

      • nchsetup.exe (PID: 3304)

  • INFO

    • Reads the computer name

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • wavepad.exe (PID: 116)
      • wavepad.exe (PID: 4004)

    • Creates files in the program directory

      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Create files in a temporary directory

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • mp3el3.exe (PID: 3992)
      • wavepad.exe (PID: 4004)

    • Checks supported languages

      • nchsetup.exe (PID: 3304)
      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • mp3el3.exe (PID: 3992)
      • wavepad.exe (PID: 4004)
      • wavepad.exe (PID: 116)

    • Reads the machine GUID from the registry

      • wavepad.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:21 05:45:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 2560
InitializedDataSize: 3062784
UninitializedDataSize: -
EntryPoint: 0x1286
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (Australian)
CharacterSet: Unicode
CompanyName: NCH Software
FileDescription: WavePad Sound Editor
FileVersion: 19.05+
ProductVersion: 19.05+
ProductName: WavePad
LegalCopyright: NCH Software
InternalName: WavePad
OriginalFileName: WavePad.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wavepadaudioeditingsoftware.exe nchsetup.exe mp3el3.exe wavepad.exe no specs wavepad.exe no specs wavepadaudioeditingsoftware.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\NCH Software\WavePad\wavepad.exe" -installschedC:\Program Files\NCH Software\WavePad\wavepad.exe—nchsetup.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\program files\nch software\wavepad\wavepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1876"C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe
explorer.exe
User:
admin
Company:
NCH Software
Integrity Level:
HIGH
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\wavepadaudioeditingsoftware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3304"C:\Users\admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" -instdata "C:\Users\admin\AppData\Local\Temp\n1s\nchdata.dat"C:\Users\admin\AppData\Local\Temp\n1s\nchsetup.exe
WavePadAudioEditingSoftware.exe
User:
admin
Company:
NCH Software
Integrity Level:
HIGH
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\n1s\nchsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3972"C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe—explorer.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
3221226540
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\wavepadaudioeditingsoftware.exe
c:\windows\system32\ntdll.dll
3992"C:\Program Files\NCH Software\WavePad\mp3el3.exe" -LQUIET -instby fiWavePad -instsvar WAVEPADRelatedprogramspaidonC:\Program Files\NCH Software\WavePad\mp3el3.exe
nchsetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\nch software\wavepad\mp3el3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4004"C:\Program Files\NCH Software\WavePad\wavepad.exe"C:\Program Files\NCH Software\WavePad\wavepad.exe—nchsetup.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\program files\nch software\wavepad\wavepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
6 064
Read events
5 498
Write events
548
Delete events
18

Modification events

(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:writeName:SVar
Value:
MMlj
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:InstallerDomain
Value:
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:_InstallerDomain
Value:
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:SVar
Value:
MMlj
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:WavePadInstall
Value:
C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:writeName:SVar
Value:
WAVEPADRelatedprogramspaidon
Executable files
7
Suspicious files
117
Text files
0
Unknown types
22

Dropped files

PID
Process
Filename
Type
1876WavePadAudioEditingSoftware.exeC:\Users\admin\AppData\Local\Temp\n1s\nchdata.cabcompressed
MD5:118014BBB3E4E5A2C6495EF4CA06B256
SHA256:4B2532D50F903E5628C1BEE0DFD945770563E8DFCC0CA618630AF4F8E7E12117
1876WavePadAudioEditingSoftware.exeC:\Users\admin\AppData\Local\Temp\n1s\nchsetup.cabcompressed
MD5:656A15FA884E4C57940164B265A1747D
SHA256:12093A31F19536A97BD9D3CAD74A2502A42B323600E8CE30B732C247A5E4B060
3304nchsetup.exeC:\Program Files\NCH Software\WavePad\wavepad.exeexecutable
MD5:DF31668C7073EBD5CEBBDA45CDCC1217
SHA256:B29408973CE6478758BC7DC5532ACC74C9787F2C011763F56D2F96A13671E9A2
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Bathroom.ecfbinary
MD5:08D543903F4E2FCE656162ACF972520C
SHA256:9670120B4B592632E0E214E261DF0A687C0EA24422180EA8057D7B38D85C9DE0
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Angel.ecfbinary
MD5:BE0E22081EF82985F053F624DD379BE8
SHA256:79F23B427BFDD7DA8C3E49A314CBA3D03D634BF1C79FCA0011238EAA235F8CDE
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Cartoon.ecfbinary
MD5:06DB84FFD4B6A1A252EEB370BE066315
SHA256:7AAA3EB9D07D276A2AD5690A41FB3E43B385697D1AD3E453BE9AC3AEBF51BC45
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Auditorium.ecfbinary
MD5:C4AB0F9BC9B579E5FAF586C39972C935
SHA256:FECB4933E24C805AAAA350B97C7C72924FEE66C5B434C3486CCF9BEC728A34F1
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Autotune Pitch.ecfbinary
MD5:A4D3076BAE8E209ABB1951503267FAC6
SHA256:F70D1A1FDFE00773A688DDD7CABDC57C6FBB0154D3609C775A24BF6594C3A326
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Big Guy.ecfbinary
MD5:A300A9EE5404EDE1D7B441E8978CF914
SHA256:CA203A7722167249F905CAB3ED71B410F07CF94103109A2E3E2A86A9D79F3814
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Autotune Robot.ecfbinary
MD5:FC843919C2F620F38D4693427BC0729B
SHA256:A2387B291EF850BC975C9F14C4F248FFB5300EACB9781E5C1FD8962EC569C558
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3304
nchsetup.exe
173.247.253.164:443
secure.nch.com.au
INMOTION
US
unknown

DNS requests

Domain
IP
Reputation
secure.nch.com.au
  • 173.247.253.164
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WavePadAudioEditingSoftware.exe