| File name: | AdwCleaner.exe |
| Full analysis: | https://app.any.run/tasks/2b998a38-7686-42eb-8727-4a8b897a94b1 |
| Verdict: | Malicious activity |
| Analysis date: | June 17, 2024, 05:55:50 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (console) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 31EBA5C542887DEE4507780B2350EB82 |
| SHA1: | 5DA1ADDCEF89747573E18D4CB361ED7D384CC3CB |
| SHA256: | 1F544DA66675521A649E632108F86AFB351AD336BD34B7B5C3D290827EBEEF54 |
| SSDEEP: | 196608:TORsUVmq00uyojm7OpiJS40B7Ar7LA7/XAKf5e3Bvn2F8/E0BzAz:TN/kGiExB7Ar7L45oeFsAz |
MALICIOUS
Drops the executable file immediately after the start
- AdwCleaner.exe (PID: 4084)
SUSPICIOUS
Reads the Internet Settings
- AdwCleaner.exe (PID: 4084)
Reads settings of System Certificates
- AdwCleaner.exe (PID: 4084)
INFO
Checks supported languages
- AdwCleaner.exe (PID: 4084)
Reads the computer name
- AdwCleaner.exe (PID: 4084)
Checks proxy server information
- AdwCleaner.exe (PID: 4084)
Reads the machine GUID from the registry
- AdwCleaner.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | UPX compressed Win32 Executable (76) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.6) |
| .exe | | | Generic Win/DOS Executable (5.6) |
| .exe | | | DOS Executable Generic (5.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:08:30 16:45:44+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 8486912 |
| InitializedDataSize: | 126976 |
| UninitializedDataSize: | 14598144 |
| EntryPoint: | 0x1604150 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 8.4.0.0 |
| ProductVersionNumber: | 8.4.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Unknown (0) |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Windows, Latin1 |
| CompanyName: | Malwarebytes |
| FileDescription: | AdwCleaner |
| FileVersion: | 8.4.0.0 |
| InternalName: | AdwCleaner |
| LegalCopyright: | Copyright 2022 Malwarebytes |
| LegalTrademarks1: | All Rights Reserved |
| LegalTrademarks2: | All Rights Reserved |
| OriginalFileName: | AdwCleaner.exe |
| ProductName: | AdwCleaner |
| ProductVersion: | 8.4 |
Total processes
37
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3968 | "C:\Users\admin\AppData\Local\Temp\AdwCleaner.exe" | C:\Users\admin\AppData\Local\Temp\AdwCleaner.exe | — | explorer.exe | |||||||||||
User: admin Company: Malwarebytes Integrity Level: MEDIUM Description: AdwCleaner Exit code: 3221226540 Version: 8.4.0.0 Modules
| |||||||||||||||
| 4084 | "C:\Users\admin\AppData\Local\Temp\AdwCleaner.exe" | C:\Users\admin\AppData\Local\Temp\AdwCleaner.exe | explorer.exe | ||||||||||||
User: admin Company: Malwarebytes Integrity Level: HIGH Description: AdwCleaner Version: 8.4.0.0 Modules
| |||||||||||||||
Total events
1 613
Read events
1 612
Write events
1
Delete events
0
Modification events
| (PID) Process: | (4084) AdwCleaner.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: AdwCleaner.exe | |||
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4084 | AdwCleaner.exe | C:\AdwCleaner\settings | binary | |
MD5:B1958D3AFD38FE10DBB3E705C24B2930 | SHA256:9D7A96611C260DB14507357B3EB8C997D3BCECC8F9C77C3C992618495BA25101 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Threats
Process | Message |
|---|---|
AdwCleaner.exe | [Application] AdwCleaner 8 . 4 . 0 launched
|
AdwCleaner.exe | [Json Parser] Failed to open file "C:\\AdwCleaner\\settings" ( "The system cannot find the file specified." )
|
AdwCleaner.exe | [AdwUpgrade] Checking application updates
|
AdwCleaner.exe | [Telemetry] Sending hello
|
AdwCleaner.exe | [Telemetry] Status code: QVariant(Invalid)
|
AdwCleaner.exe | QIODevice::read (QDisabledNetworkReply): device not open
|
AdwCleaner.exe | [File Downloader] Error downloading ( QNetworkReply::UnknownNetworkError )
|
AdwCleaner.exe | [Button clicked] EULA agreed
|