File name:

Core-Temp-setup-v1.18.1.0.exe

Full analysis: https://app.any.run/tasks/9641b502-330a-4f0f-85f7-c00386b6a2d6
Verdict: Malicious activity
Analysis date: February 11, 2024, 04:19:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

176642114EE7A82E0486BF5FAC5777C0

SHA1:

F4329A1AFC37F143BA1D39D9670CA4B1ACD61C23

SHA256:

CA7D1365E934B3BD122AB8B0DBD24EF5E0C52471CFCA15921555FC6B244E9AB6

SSDEEP:

49152:TwE0bqq2LkelPNf4qz2ZBQq9RuNkDtz7OU4SD3e9yDZocZIOtAcAmWoz4IY3WO+y:z0bBWTJ4VBL9RBtzBO9yGgMu40X9SFuu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4052)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 3848)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)
      • Core Temp.exe (PID: 2648)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4052)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 3848)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)
      • Core Temp.exe (PID: 2648)

    • Reads the Windows owner or organization settings

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)

    • Start notepad (likely ransomware note)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3652)

    • Reads the Internet Settings

      • Core Temp.exe (PID: 2648)

    • Drops a system driver (possible attempt to evade defenses)

      • Core Temp.exe (PID: 2648)

  • INFO

    • Checks supported languages

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4052)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3652)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 3848)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)
      • Core Temp.exe (PID: 2648)

    • Create files in a temporary directory

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4052)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 3848)
      • Core Temp.exe (PID: 2648)

    • Reads the computer name

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3652)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)
      • Core Temp.exe (PID: 2648)

    • Creates files in the program directory

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)
      • Core Temp.exe (PID: 2648)

    • Creates a software uninstall entry

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3948)

    • Reads the machine GUID from the registry

      • Core Temp.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.18.1.0
ProductVersionNumber: 1.18.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ALCPU
FileDescription: Core Temp Setup
FileVersion: 1.18.1.0
LegalCopyright:
ProductName: Core Temp
ProductVersion: 1.18.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp no specs core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp notepad.exe no specs core temp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1692"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txtC:\Windows\System32\notepad.exe—Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2648"C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
3221225477
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3652"C:\Users\admin\AppData\Local\Temp\is-GU6HI.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$E0170,868100,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\is-GU6HI.tmp\Core-Temp-setup-v1.18.1.0.tmp—Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-gu6hi.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3848"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$17013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3948"C:\Users\admin\AppData\Local\Temp\is-E6FRH.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$100130,868100,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$17013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-E6FRH.tmp\Core-Temp-setup-v1.18.1.0.tmp
Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-e6frh.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
4052"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
9 432
Read events
9 340
Write events
81
Delete events
11

Modification events

(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
6C0F0000BAC8F287A15CDA01
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
8AFD0BA3ABDF6533F33AA2AE8B6C2E2E10D3114818EC2222DECC40BB5DFED660
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Core Temp\Core Temp.exe
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
52E670EDAB2E537A2E03A1BDED2220C55D2312C98B1910BA6B13720D6F89570B
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (u)
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Core Temp
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Core Temp\
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Core Temp
(PID) Process:(3948) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
7
Suspicious files
4
Text files
72
Unknown types
0

Dropped files

PID
Process
Filename
Type
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Readme.txttext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-V3JU1.tmptext
MD5:9AB877751224D96448876F7ECF15559F
SHA256:ABB84CF36BD0E8F39248F5477CA0D427DA9B7E3C10B6666254B98D6E06B40E7B
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Changes.txttext
MD5:0FF2E6869879C98DC6144F3384DB16A0
SHA256:87E330164B239690BA6E3B99F16768CEE7C457225C2971C7C3E52C0E21F95332
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-QOS92.tmpexecutable
MD5:8020FA51D506EA8156CE626D6E2A3523
SHA256:FF3F2F727CBA879A6F901BCFE07B66A79BED0F75AF993A73765E4BA52F8A5865
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-TV0I5.tmptext
MD5:932B5FB4B60BBA2DBF7D178518C69670
SHA256:37C7CC1DEE0A655060E37333B4D99E697DAD5C197FFDB30BF136E1412C5D70D8
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Core Temp.exeexecutable
MD5:8020FA51D506EA8156CE626D6E2A3523
SHA256:FF3F2F727CBA879A6F901BCFE07B66A79BED0F75AF993A73765E4BA52F8A5865
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-2FI77.tmpexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\unins000.exeexecutable
MD5:E535020EB53AF0A8CC69FD8180F7275E
SHA256:F515206B2C2FD3A59CF6F003143EFCA98456E2BDC4B7A8F622BEB98F735CF667
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-U8F5A.tmptext
MD5:0FF2E6869879C98DC6144F3384DB16A0
SHA256:87E330164B239690BA6E3B99F16768CEE7C457225C2971C7C3E52C0E21F95332
3948Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Languages\is-M28O6.tmpxml
MD5:4EA78FDD1EFD2D4756BC1E4F16B3DF00
SHA256:B88748DB05E055D523562DAFC6A8782B15DD95DA433EFB159F92F13D4127D708
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1348
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core-Temp-setup-v1.18.1.0.exe