We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
24 November 2020, 03:44
Analysis environment:
Windows 7 Pro, build 7601, x86
avg_driver_updater_online_setup.exe
MD5:
1C5BF9A7BA798049418E33FC3123ECB8
SHA1:
C6DB14BFB50D316C3AFDF671A2E8B2FB9C4CDC95
SHA256:
79391288CAE0894F4C8F6969B49EDBB6E1D9C5C42F5211F613C936318B7B0AC5
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis avg_driver_updater_online_setup.exe (MD5: 1C5BF9A7BA798049418E33FC3123ECB8) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes settings of System certificates
avg_driver_updater_online_setup.exe (PID: 3708)
Application was dropped or rewritten from another process
icarus.exe (PID: 2716)
icarus.exe (PID: 396)
icarus_ui.exe (PID: 656)
Loads dropped or rewritten executable
icarus.exe (PID: 396)
SUSPICIOUS
Low-level read access rights to disk partition
avg_driver_updater_online_setup.exe (PID: 3708)
icarus.exe (PID: 2716)
icarus.exe (PID: 396)
Adds / modifies Windows certificates
avg_driver_updater_online_setup.exe (PID: 3708)
Creates files in the program directory
avg_driver_updater_online_setup.exe (PID: 3708)
icarus.exe (PID: 2716)
icarus_ui.exe (PID: 656)
icarus.exe (PID: 396)
Creates or modifies windows services
icarus.exe (PID: 2716)
Executable content was dropped or overwritten
avg_driver_updater_online_setup.exe (PID: 3708)
icarus.exe (PID: 2716)
icarus.exe (PID: 396)
Creates files in the Windows directory
avg_driver_updater_online_setup.exe (PID: 3708)
icarus.exe (PID: 2716)
Drops a file that was compiled in debug mode
avg_driver_updater_online_setup.exe (PID: 3708)
icarus.exe (PID: 2716)
icarus.exe (PID: 396)
Starts itself from another location
icarus.exe (PID: 2716)
Creates a directory in Program Files
icarus.exe (PID: 396)
Drops a file with a compile date too recent
icarus.exe (PID: 396)
Drops a file with too old compile date
icarus.exe (PID: 396)
INFO
Reads the hosts file
icarus.exe (PID: 2716)
icarus.exe (PID: 396)
Dropped object may contain Bitcoin addresses
icarus.exe (PID: 396)
Threats
No threats detected