File name: | Taskbarify.exe |
Full analysis: | https://app.any.run/tasks/a8c49864-8b97-473b-ab28-348ec9cda671 |
Verdict: | Malicious activity |
Analysis date: | November 07, 2023, 13:59:13 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
MD5: | 798A870C8D7C0027C829586BF63C2B4F |
SHA1: | E86593B1EF9D4E434C2E95F3061FA5D2012598D1 |
SHA256: | 741F68A10A6369D383BEEAB44596A33A919803CB061BEAAE48CDE8FB4B7EC037 |
SSDEEP: | 1536:y1Ug9r7MGuI8a9bj1JKN/Tc9dkDbDmam7Bl+ElQPVEjElJPVNI:y1Ouz9bj1ANdDbDmasrDQNbJNy |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
AssemblyVersion: | 1.0.0.1 |
---|---|
ProductVersion: | 1.0.0.1 |
ProductName: | Taskbarify |
OriginalFileName: | Taskbarify.exe |
LegalTrademarks: | - |
LegalCopyright: | Copyright © 2023 Taskbarify |
InternalName: | Taskbarify.exe |
FileVersion: | 1.0.0.1 |
FileDescription: | Taskbarify |
CompanyName: | - |
Comments: | - |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.0.0.1 |
FileVersionNumber: | 1.0.0.1 |
Subsystem: | Windows GUI |
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x93b0a |
UninitializedDataSize: | - |
InitializedDataSize: | 290816 |
CodeSize: | 596992 |
LinkerVersion: | 48 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2062:06:07 16:13:07+02:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3416 | "C:\Users\admin\AppData\Local\Temp\Taskbarify.exe" | C:\Users\admin\AppData\Local\Temp\Taskbarify.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Taskbarify Version: 1.0.0.1 Modules
| |||||||||||||||
3456 | dw20.exe -x -s 860 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe | — | Taskbarify.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Error Reporting Shim Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400) Modules
|
(PID) Process: | (3416) Taskbarify.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3456) dw20.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles |
Operation: | write | Name: | FirstLevelConsentDialog |
Value: 7603050000000000 | |||
(PID) Process: | (3456) dw20.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles |
Operation: | write | Name: | FirstLevelConsentDialog |
Value: 7603050000000000 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |