File name:

WavePadAudioEditingSoftware.exe

Full analysis: https://app.any.run/tasks/eed6cc2c-6a96-4d26-bceb-454b2ed008bc
Verdict: Malicious activity
Analysis date: March 14, 2024, 09:46:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

DFAE5190306A755668CA07949F1DBD59

SHA1:

7FE59EABB62FA81DF40D51CCF82A3C22DCE50214

SHA256:

6DAF28E5975B862F816C2D47D553790DE5E113345EF501B4DF90089895147C89

SSDEEP:

98304:IlWUf6we6ofe60BBfqGUivA3imGxxXku56eDczRVUHcX1upgzdjAATGr9UgPTCYO:+BCfhv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Changes the autorun value in the registry

      • nchsetup.exe (PID: 3304)

  • SUSPICIOUS

    • Reads the Internet Settings

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)

    • Executable content was dropped or overwritten

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Reads security settings of Internet Explorer

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)

    • Creates a software uninstall entry

      • nchsetup.exe (PID: 3304)

    • Starts itself from another location

      • nchsetup.exe (PID: 3304)

    • Searches for installed software

      • nchsetup.exe (PID: 3304)

  • INFO

    • Checks supported languages

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)
      • wavepad.exe (PID: 116)
      • wavepad.exe (PID: 4004)

    • Reads the computer name

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • nchsetup.exe (PID: 3304)
      • wavepad.exe (PID: 116)
      • wavepad.exe (PID: 4004)

    • Create files in a temporary directory

      • WavePadAudioEditingSoftware.exe (PID: 1876)
      • mp3el3.exe (PID: 3992)
      • wavepad.exe (PID: 4004)

    • Creates files in the program directory

      • nchsetup.exe (PID: 3304)
      • mp3el3.exe (PID: 3992)

    • Reads the machine GUID from the registry

      • wavepad.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:21 05:45:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 2560
InitializedDataSize: 3062784
UninitializedDataSize: -
EntryPoint: 0x1286
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (Australian)
CharacterSet: Unicode
CompanyName: NCH Software
FileDescription: WavePad Sound Editor
FileVersion: 19.05+
ProductVersion: 19.05+
ProductName: WavePad
LegalCopyright: NCH Software
InternalName: WavePad
OriginalFileName: WavePad.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wavepadaudioeditingsoftware.exe nchsetup.exe mp3el3.exe wavepad.exe no specs wavepad.exe no specs wavepadaudioeditingsoftware.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\NCH Software\WavePad\wavepad.exe" -installschedC:\Program Files\NCH Software\WavePad\wavepad.exe—nchsetup.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\program files\nch software\wavepad\wavepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1876"C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe
explorer.exe
User:
admin
Company:
NCH Software
Integrity Level:
HIGH
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\wavepadaudioeditingsoftware.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3304"C:\Users\admin\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" -instdata "C:\Users\admin\AppData\Local\Temp\n1s\nchdata.dat"C:\Users\admin\AppData\Local\Temp\n1s\nchsetup.exe
WavePadAudioEditingSoftware.exe
User:
admin
Company:
NCH Software
Integrity Level:
HIGH
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\n1s\nchsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3972"C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe" C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe—explorer.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
3221226540
Version:
19.05+
Modules
Images
c:\users\admin\appdata\local\temp\wavepadaudioeditingsoftware.exe
c:\windows\system32\ntdll.dll
3992"C:\Program Files\NCH Software\WavePad\mp3el3.exe" -LQUIET -instby fiWavePad -instsvar WAVEPADRelatedprogramspaidonC:\Program Files\NCH Software\WavePad\mp3el3.exe
nchsetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\nch software\wavepad\mp3el3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
4004"C:\Program Files\NCH Software\WavePad\wavepad.exe"C:\Program Files\NCH Software\WavePad\wavepad.exe—nchsetup.exe
User:
admin
Company:
NCH Software
Integrity Level:
MEDIUM
Description:
WavePad Sound Editor
Exit code:
0
Version:
19.05+
Modules
Images
c:\program files\nch software\wavepad\wavepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
6 064
Read events
5 498
Write events
548
Delete events
18

Modification events

(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1876) WavePadAudioEditingSoftware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:writeName:SVar
Value:
MMlj
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:InstallerDomain
Value:
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:_InstallerDomain
Value:
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:delete valueName:SVar
Value:
MMlj
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:WavePadInstall
Value:
C:\Users\admin\AppData\Local\Temp\WavePadAudioEditingSoftware.exe
(PID) Process:(3304) nchsetup.exeKey:HKEY_CURRENT_USER\Software\NCH Software\WavePad\Software
Operation:writeName:SVar
Value:
WAVEPADRelatedprogramspaidon
Executable files
7
Suspicious files
117
Text files
0
Unknown types
22

Dropped files

PID
Process
Filename
Type
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Alien.ecfbinary
MD5:22D79730E80268A133D3D7FCA2856F57
SHA256:495CEC973BBB5B01AC4BFE2018C6EC096EDDC932B447797965842C5CBB7A977C
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Auditorium.ecfbinary
MD5:C4AB0F9BC9B579E5FAF586C39972C935
SHA256:FECB4933E24C805AAAA350B97C7C72924FEE66C5B434C3486CCF9BEC728A34F1
1876WavePadAudioEditingSoftware.exeC:\Users\admin\AppData\Local\Temp\n1s\nchdata.datexecutable
MD5:18689ED1BF6B4561888EC83597F9D9C8
SHA256:E68154EDB9150C72D69E9B570DBED46331F14197E8BFD019F655C474E88E4F26
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\AM Radio.ecfbinary
MD5:E4306615BA7865823AD5E03B60AC9A4B
SHA256:B98651A71FA9E5412199F7DF29C41BD350BE97E5B2D57F4076DA3D6C8D662F6C
3304nchsetup.exeC:\ProgramData\NCH Software\WavePad\presets\Autotune Pitch.ecfbinary
MD5:A4D3076BAE8E209ABB1951503267FAC6
SHA256:F70D1A1FDFE00773A688DDD7CABDC57C6FBB0154D3609C775A24BF6594C3A326
1876WavePadAudioEditingSoftware.exeC:\Users\admin\AppData\Local\Temp\n1s\nchsetup.exeexecutable
MD5:DF31668C7073EBD5CEBBDA45CDCC1217
SHA256:B29408973CE6478758BC7DC5532ACC74C9787F2C011763F56D2F96A13671E9A2
3304nchsetup.exeC:\Program Files\NCH Software\WavePad\shellmenu.dllexecutable
MD5:3B487CA42A964C1C1E54F37DACB68C08
SHA256:DEE72D314443937472CA6A6FAC22593BA8129F6AFB486EC95163DD4B32F61264
1876WavePadAudioEditingSoftware.exeC:\Users\admin\AppData\Local\Temp\n1s\nchdata.cabcompressed
MD5:118014BBB3E4E5A2C6495EF4CA06B256
SHA256:4B2532D50F903E5628C1BEE0DFD945770563E8DFCC0CA618630AF4F8E7E12117
3304nchsetup.exeC:\Program Files\NCH Software\WavePad\wavepad.exeexecutable
MD5:DF31668C7073EBD5CEBBDA45CDCC1217
SHA256:B29408973CE6478758BC7DC5532ACC74C9787F2C011763F56D2F96A13671E9A2
3304nchsetup.exeC:\Program Files\NCH Software\WavePad\shellmenub.msixcompressed
MD5:28256516757F987429417FF6C4D7BFCB
SHA256:9FD363C5E3D3E1DECC422DFF301A3EF223FFCA7AA79F6433A81A88B46FE864BE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3304
nchsetup.exe
173.247.253.164:443
secure.nch.com.au
INMOTION
US
unknown

DNS requests

Domain
IP
Reputation
secure.nch.com.au
  • 173.247.253.164
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WavePadAudioEditingSoftware.exe