File name:

Core-Temp-setup-v1.18.1.0.exe

Full analysis: https://app.any.run/tasks/b8182b8c-4cf4-4862-8041-9fdfb68cc912
Verdict: Malicious activity
Analysis date: April 12, 2024, 00:01:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

176642114EE7A82E0486BF5FAC5777C0

SHA1:

F4329A1AFC37F143BA1D39D9670CA4B1ACD61C23

SHA256:

CA7D1365E934B3BD122AB8B0DBD24EF5E0C52471CFCA15921555FC6B244E9AB6

SSDEEP:

49152:TwE0bqq2LkelPNf4qz2ZBQq9RuNkDtz7OU4SD3e9yDZocZIOtAcAmWoz4IY3WO+y:z0bBWTJ4VBL9RBtzBO9yGgMu40X9SFuu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4008)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 2672)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)
      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 3224)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Core-Temp-setup-v1.18.1.0.exe (PID: 2672)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 4008)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 3224)

    • Reads the Windows owner or organization settings

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)

    • Start notepad (likely ransomware note)

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3956)

    • Non-standard symbols in registry

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)

    • Drops a system driver (possible attempt to evade defenses)

      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 3224)

  • INFO

    • Checks supported languages

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3956)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 2672)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 4008)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)
      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 3224)

    • Reads the computer name

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 3956)
      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 3224)

    • Create files in a temporary directory

      • Core-Temp-setup-v1.18.1.0.exe (PID: 4008)
      • Core-Temp-setup-v1.18.1.0.exe (PID: 2672)
      • Core Temp.exe (PID: 2184)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 3224)

    • Creates a software uninstall entry

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)

    • Creates files in the program directory

      • Core-Temp-setup-v1.18.1.0.tmp (PID: 956)
      • Core Temp.exe (PID: 2184)

    • Reads the machine GUID from the registry

      • Core Temp.exe (PID: 1844)

    • Manual execution by a user

      • Core Temp.exe (PID: 492)
      • Core Temp.exe (PID: 1572)
      • Core Temp.exe (PID: 1844)
      • Core Temp.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 13:27:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.18.1.0
ProductVersionNumber: 1.18.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ALCPU
FileDescription: Core Temp Setup
FileVersion: 1.18.1.0
LegalCopyright:
ProductName: Core Temp
ProductVersion: 1.18.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
10
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp no specs core-temp-setup-v1.18.1.0.exe core-temp-setup-v1.18.1.0.tmp notepad.exe no specs core temp.exe core temp.exe no specs core temp.exe core temp.exe no specs core temp.exe

Process information

PID
CMD
Path
Indicators
Parent process
492"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe—explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
CPU temperature and system information utility
Exit code:
3221226540
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
956"C:\Users\admin\AppData\Local\Temp\is-CL6R2.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$100130,868100,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$150180 /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-CL6R2.tmp\Core-Temp-setup-v1.18.1.0.tmp
Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cl6r2.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1572"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe—explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
CPU temperature and system information utility
Exit code:
3221226540
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
1844"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2072"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txtC:\Windows\System32\notepad.exe—Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2184"C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2672"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" /SPAWNWND=$150180 /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe
Core-Temp-setup-v1.18.1.0.tmp
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3224"C:\Program Files\Core Temp\Core Temp.exe" C:\Program Files\Core Temp\Core Temp.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
HIGH
Description:
CPU temperature and system information utility
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\program files\core temp\core temp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3956"C:\Users\admin\AppData\Local\Temp\is-J2S7S.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$E0170,868100,121344,C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\is-J2S7S.tmp\Core-Temp-setup-v1.18.1.0.tmp—Core-Temp-setup-v1.18.1.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-j2s7s.tmp\core-temp-setup-v1.18.1.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
4008"C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe" C:\Users\admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe
explorer.exe
User:
admin
Company:
ALCPU
Integrity Level:
MEDIUM
Description:
Core Temp Setup
Exit code:
0
Version:
1.18.1.0
Modules
Images
c:\users\admin\appdata\local\temp\core-temp-setup-v1.18.1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
9 652
Read events
9 570
Write events
72
Delete events
10

Modification events

(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
BC030000167CCF9B6C8CDA01
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
66F203D33C53DB256F80A10A2CCB14650F7511BF8B9A63450FC457FFAD36DE7E
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Core Temp\Core Temp.exe
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
D40D8707AF9B16026AFFFA36BED868D4BCAA690C1141DE58685D382570F95D7D
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.6.1 (u)
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\Core Temp
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\Core Temp\
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Core Temp
(PID) Process:(956) Core-Temp-setup-v1.18.1.0.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1
Operation:writeName:Inno Setup: User
Value:
admin
Executable files
9
Suspicious files
0
Text files
72
Unknown types
4

Dropped files

PID
Process
Filename
Type
4008Core-Temp-setup-v1.18.1.0.exeC:\Users\admin\AppData\Local\Temp\is-J2S7S.tmp\Core-Temp-setup-v1.18.1.0.tmpexecutable
MD5:—
SHA256:—
2672Core-Temp-setup-v1.18.1.0.exeC:\Users\admin\AppData\Local\Temp\is-CL6R2.tmp\Core-Temp-setup-v1.18.1.0.tmpexecutable
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-2CBD5.tmpexecutable
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\unins000.exeexecutable
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-HV8OH.tmptext
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Changes.txttext
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-BIMKL.tmpexecutable
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Core Temp.exeexecutable
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\is-O7BHD.tmptext
MD5:—
SHA256:—
956Core-Temp-setup-v1.18.1.0.tmpC:\Program Files\Core Temp\Readme.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core-Temp-setup-v1.18.1.0.exe