File name:

CurseForge Windows - Installer.exe

Full analysis: https://app.any.run/tasks/fb2b9fad-fc42-48bc-8e70-206eb56af11e
Verdict: Malicious activity
Analysis date: December 02, 2023, 20:11:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

5D75E4FA52A95BA16DC90D3FFF44C4E3

SHA1:

76CEC65694E74DFDAEB46017DE2A395804FEBC1C

SHA256:

C06A456D1213E3488B9157F6DC01F447E401FBCEB0FFE256398CC94F841384CD

SSDEEP:

98304:fjnOmTYRaJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhInf6HloCaP1HFTPBAAIG/:WVi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CurseForge Windows - Installer.exe (PID: 2144)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • CurseForge Windows - Installer.exe (PID: 2144)

    • Drops 7-zip archiver for unpacking

      • CurseForge Windows - Installer.exe (PID: 2144)

    • The process creates files with name similar to system file names

      • CurseForge Windows - Installer.exe (PID: 2144)

  • INFO

    • Checks supported languages

      • CurseForge Windows - Installer.exe (PID: 2144)

    • Reads the computer name

      • CurseForge Windows - Installer.exe (PID: 2144)

    • Create files in a temporary directory

      • CurseForge Windows - Installer.exe (PID: 2144)

    • Reads Environment values

      • CurseForge Windows - Installer.exe (PID: 2144)

    • Creates files or folders in the user directory

      • CurseForge Windows - Installer.exe (PID: 2144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 23:57:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 186880
UninitializedDataSize: 2048
EntryPoint: 0x352d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.240.0.4
ProductVersionNumber: 2.240.0.4
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Overwolf Ltd.
FileDescription: Curseforge
FileVersion: 2.240.0.4
LegalCopyright: Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks: -
ProductName: Curseforge
ProductVersion: 2.240.0.4
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start curseforge windows - installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2144"C:\Users\admin\AppData\Local\Temp\CurseForge Windows - Installer.exe" C:\Users\admin\AppData\Local\Temp\CurseForge Windows - Installer.exe—explorer.exe
User:
admin
Company:
Overwolf Ltd.
Integrity Level:
MEDIUM
Description:
Curseforge
Exit code:
0
Version:
2.240.0.4
Modules
Images
c:\users\admin\appdata\local\temp\curseforge windows - installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
663
Read events
663
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
18
Text files
59
Unknown types
0

Dropped files

PID
Process
Filename
Type
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\OWInstaller.exeexecutable
MD5:62F7BB2373ED00D482166851A95C15EA
SHA256:C249A806F8D2B221042BA0A3E91BCF9EC7DA1F47F5D46C6DE3E6CDB1B86F02A5
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\System.dllexecutable
MD5:7399323923E3946FE9140132AC388132
SHA256:5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\UserInfo.dllexecutable
MD5:9301577FF4D229347FE33259B43EF3B2
SHA256:090C4BC8DC534E97B3877BD5115EB58B3E181495F29F231479F540BAB5C01EDC
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\Newtonsoft.Json.dllexecutable
MD5:98CBB64F074DC600B23A2EE1A0F46448
SHA256:7B44639CBFBC8DDAC8C7A3DE8FFA97A7460BEBB0D54E9FF2E1CCDC3A742C2B13
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\uac.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\nsProcess.dllexecutable
MD5:F0438A894F3A7E01A4AAE8D1B5DD0289
SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\SharpRaven.dllexecutable
MD5:0EB30D22448E520D2DEAC31105263907
SHA256:F09E2797C0B98EA248E01330E0C77FB23189A18F2A6D7F22842087BBBB39F3AE
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\nsis7z64.dllexecutable
MD5:284C46AF1FD2EC3A60EE0C28F276F2A4
SHA256:2368BE6D8B21E0047146D3F61F90966A71D0737EED0146BC692B59F3CAC97793
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\app\cmp.htmlhtml
MD5:D410DA4CF0F95A0F4515AF423C8E0C4E
SHA256:26331F18A2F2C63367B1F1D6B5A5B14D4FB13AD52FB04A5A095C260007E931D7
2144CurseForge Windows - Installer.exeC:\Users\admin\AppData\Local\Temp\nsx6854.tmp\websocket-sharp.dllexecutable
MD5:185124E74EA79B3F17C88A64C8A4BF3F
SHA256:A5414E1865F092496509477D2ADF12268C52716786839EB90AB778DC99019324
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CurseForge Windows - Installer.exe