File name:

Thunderstore Mod Manager - Installer.exe

Full analysis: https://app.any.run/tasks/3e3065ad-074a-4cd6-889d-241ccf560bcb
Verdict: Malicious activity
Analysis date: November 29, 2023, 20:48:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

611B76F998F33CAA3FB8E3D493BDC051

SHA1:

7DA30D244B475183B74AF287548F290D5FFA1DC3

SHA256:

B67A702578800EDDAF222051003926A065C090274F017A1B31E325120A4EE7B2

SSDEEP:

98304:jk2iYvNJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhInf6HloCaP1HFTPBAAIGReo:tAVi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)
      • Thunderstore Mod Manager - Installer.exe (PID: 2936)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Drops 7-zip archiver for unpacking

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Application launched itself

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)

    • Reads the Internet Settings

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

  • INFO

    • Checks supported languages

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)
      • wmpnscfg.exe (PID: 2416)

    • Reads the computer name

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)
      • wmpnscfg.exe (PID: 2416)

    • Create files in a temporary directory

      • Thunderstore Mod Manager - Installer.exe (PID: 2936)
      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Checks proxy server information

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Reads the machine GUID from the registry

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)
      • wmpnscfg.exe (PID: 2416)

    • Reads Environment values

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Creates files or folders in the user directory

      • Thunderstore Mod Manager - Installer.exe (PID: 2476)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 23:57:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x352d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.240.0.4
ProductVersionNumber: 2.240.0.4
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Overwolf Ltd.
FileDescription: Overwolf
FileVersion: 2.240.0.4
LegalCopyright: Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks: -
ProductName: Overwolf
ProductVersion: 2.240.0.4
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start thunderstore mod manager - installer.exe no specs thunderstore mod manager - installer.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2416"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2476"C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.exe" /UAC:80190 /NCRC C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.exe
Thunderstore Mod Manager - Installer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
HIGH
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\appdata\local\temp\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2936"C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.exe" C:\Users\admin\AppData\Local\Temp\Thunderstore Mod Manager - Installer.exe—explorer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
MEDIUM
Description:
Overwolf
Exit code:
1223
Version:
2.240.0.4
Modules
Images
c:\users\admin\appdata\local\temp\thunderstore mod manager - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
1 620
Read events
1 604
Write events
13
Delete events
3

Modification events

(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2476) Thunderstore Mod Manager - Installer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsrE404.tmp\utils.dll
(PID) Process:(2416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{BFA4EB03-DD8C-43E3-AC82-D9D8C15D6A70}\{0D1ED7D9-89C7-44E4-8551-D803765F8B28}
Operation:delete keyName:(default)
Value:
Executable files
32
Suspicious files
37
Text files
115
Unknown types
0

Dropped files

PID
Process
Filename
Type
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\app\cmp.htmlhtml
MD5:D410DA4CF0F95A0F4515AF423C8E0C4E
SHA256:26331F18A2F2C63367B1F1D6B5A5B14D4FB13AD52FB04A5A095C260007E931D7
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\nsProcess.dllexecutable
MD5:F0438A894F3A7E01A4AAE8D1B5DD0289
SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\uac.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\log4net.dllexecutable
MD5:F15C8A9E2876568B3910189B2D493706
SHA256:AE9C8073C3357C490F5D1C64101362918357C568F6B9380A60B09A4A4C1FF309
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\websocket-sharp.dllexecutable
MD5:185124E74EA79B3F17C88A64C8A4BF3F
SHA256:A5414E1865F092496509477D2ADF12268C52716786839EB90AB778DC99019324
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\Newtonsoft.Json.dllexecutable
MD5:98CBB64F074DC600B23A2EE1A0F46448
SHA256:7B44639CBFBC8DDAC8C7A3DE8FFA97A7460BEBB0D54E9FF2E1CCDC3A742C2B13
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\SharpRaven.dllexecutable
MD5:0EB30D22448E520D2DEAC31105263907
SHA256:F09E2797C0B98EA248E01330E0C77FB23189A18F2A6D7F22842087BBBB39F3AE
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:AA5EBFF82CEF6EF1A15C468E6055356F
SHA256:7F47038A76EE0D39498299DECABD203A45991A0D8D03B63EC588108DD50678AA
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\DotNetZip.dllexecutable
MD5:190E712F2E3B065BA3D5F63CB9B7725E
SHA256:6C512D9943A225D686B26FC832589E4C8BEF7C4DD0A8BDFD557D5D27FE5BBA0F
2936Thunderstore Mod Manager - Installer.exeC:\Users\admin\AppData\Local\Temp\nskDE19.tmp\UserInfo.dllexecutable
MD5:9301577FF4D229347FE33259B43EF3B2
SHA256:090C4BC8DC534E97B3877BD5115EB58B3E181495F29F231479F540BAB5C01EDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2476
Thunderstore Mod Manager - Installer.exe
GET
200
65.9.95.117:80
http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.240.0.4%22%7d%5d
unknown
binary
2 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2476
Thunderstore Mod Manager - Installer.exe
65.9.95.117:80
analyticsnew.overwolf.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
analyticsnew.overwolf.com
  • 65.9.95.117
  • 65.9.95.59
  • 65.9.95.121
  • 65.9.95.125
unknown

Threats

PID
Process
Class
Message
2476
Thunderstore Mod Manager - Installer.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Thunderstore Mod Manager - Installer.exe