File name:

Install NucleoView NC-200 1.4.3.0.exe

Full analysis: https://app.any.run/tasks/39ed4502-be6d-47ed-bcba-ab1579128b23
Verdict: Malicious activity
Analysis date: April 12, 2024, 13:51:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C2E290BB72AE9D4090F62A1EF7AEAC51

SHA1:

0193264F2495F98A97B03893C8A6492E1B72916E

SHA256:

ECB91B53E3B24D6AB81A0F3002550DDE6BC14270384CD76707D62462106BFC49

SSDEEP:

12288:srGdJ6WyagnioIPvrTV0LS2dBVBXuZguAp7Tuc+:sSdoWyagnioIPvrJiS2dBVBXuKuC7TuZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Install NucleoView NC-200 1.4.3.0.exe (PID: 4008)
      • Install NucleoView NC-200 1.4.3.0.exe (PID: 2672)
      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Install NucleoView NC-200 1.4.3.0.exe (PID: 2672)
      • Install NucleoView NC-200 1.4.3.0.exe (PID: 4008)
      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)

    • Reads the Windows owner or organization settings

      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)

    • Process drops legitimate windows executable

      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)

  • INFO

    • Checks supported languages

      • Install NucleoView NC-200 1.4.3.0.exe (PID: 4008)
      • Install NucleoView NC-200 1.4.3.0.exe (PID: 2672)
      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)
      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 3956)

    • Reads the computer name

      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 3956)
      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)

    • Create files in a temporary directory

      • Install NucleoView NC-200 1.4.3.0.tmp (PID: 956)
      • Install NucleoView NC-200 1.4.3.0.exe (PID: 2672)
      • Install NucleoView NC-200 1.4.3.0.exe (PID: 4008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.3.0
ProductVersionNumber: 1.4.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: ChemoMetec A/S
FileDescription: NucleoView NC-200 Installer
FileVersion: 1.4.3.0
LegalCopyright: Copyright © ChemoMetec A/S 2010. All rights reserved.
ProductName: NucleoView NC-200
ProductVersion: 1.4.3.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start install nucleoview nc-200 1.4.3.0.exe install nucleoview nc-200 1.4.3.0.tmp no specs install nucleoview nc-200 1.4.3.0.exe install nucleoview nc-200 1.4.3.0.tmp

Process information

PID
CMD
Path
Indicators
Parent process
956"C:\Users\admin\AppData\Local\Temp\is-K7VFH.tmp\Install NucleoView NC-200 1.4.3.0.tmp" /SL5="$19013E,54272,0,C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-K7VFH.tmp\Install NucleoView NC-200 1.4.3.0.tmp
Install NucleoView NC-200 1.4.3.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-k7vfh.tmp\install nucleoview nc-200 1.4.3.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2672"C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe" /SPAWNWND=$1A01BC /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe
Install NucleoView NC-200 1.4.3.0.tmp
User:
admin
Company:
ChemoMetec A/S
Integrity Level:
HIGH
Description:
NucleoView NC-200 Installer
Version:
1.4.3.0
Modules
Images
c:\users\admin\appdata\local\temp\install nucleoview nc-200 1.4.3.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3956"C:\Users\admin\AppData\Local\Temp\is-CFQLH.tmp\Install NucleoView NC-200 1.4.3.0.tmp" /SL5="$E0170,54272,0,C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe" C:\Users\admin\AppData\Local\Temp\is-CFQLH.tmp\Install NucleoView NC-200 1.4.3.0.tmp—Install NucleoView NC-200 1.4.3.0.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cfqlh.tmp\install nucleoview nc-200 1.4.3.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
4008"C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe" C:\Users\admin\AppData\Local\Temp\Install NucleoView NC-200 1.4.3.0.exe
explorer.exe
User:
admin
Company:
ChemoMetec A/S
Integrity Level:
MEDIUM
Description:
NucleoView NC-200 Installer
Version:
1.4.3.0
Modules
Images
c:\users\admin\appdata\local\temp\install nucleoview nc-200 1.4.3.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
6 181
Read events
6 170
Write events
11
Delete events
0

Modification events

(PID) Process:(956) Install NucleoView NC-200 1.4.3.0.tmpKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(956) Install NucleoView NC-200 1.4.3.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(956) Install NucleoView NC-200 1.4.3.0.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
4008Install NucleoView NC-200 1.4.3.0.exeC:\Users\admin\AppData\Local\Temp\is-CFQLH.tmp\Install NucleoView NC-200 1.4.3.0.tmpexecutable
MD5:—
SHA256:—
2672Install NucleoView NC-200 1.4.3.0.exeC:\Users\admin\AppData\Local\Temp\is-K7VFH.tmp\Install NucleoView NC-200 1.4.3.0.tmpexecutable
MD5:—
SHA256:—
956Install NucleoView NC-200 1.4.3.0.tmpC:\Users\admin\AppData\Local\Temp\is-IG7F4.tmp\_isetup\_RegDLL.tmpexecutable
MD5:—
SHA256:—
956Install NucleoView NC-200 1.4.3.0.tmpC:\Users\admin\AppData\Local\Temp\is-IG7F4.tmp\_isetup\_shfoldr.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Install NucleoView NC-200 1.4.3.0.exe