File name:

UnCleaner.exe

Full analysis: https://app.any.run/tasks/93752b50-0d8f-4ec3-83f8-dd54d71196a3
Verdict: Malicious activity
Analysis date: November 23, 2023, 10:02:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

B085DE3A7B5E05AC0214024429581852

SHA1:

019CD1E2270DCF97A47350B879AE6665A444CF35

SHA256:

C7905B423215DE32F011DF247829DEDA009BF11D3E481D4A303BA6D84802747A

SSDEEP:

98304:E6IxFJA3HHLfr1qGR8yIYf7Ou1cGSGpR84T+AGjnpqZRSJr2NnCbaeGvFfBUoVLg:dy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • UnCleaner.exe (PID: 3496)
      • UnCleaner.exe (PID: 3724)

    • Actions looks like stealing of personal data

      • UnCleaner.exe (PID: 3496)
      • UnCleaner.exe (PID: 3724)

  • SUSPICIOUS

    • Reads the Internet Settings

      • UnCleaner.exe (PID: 3496)

    • Reads Internet Explorer settings

      • UnCleaner.exe (PID: 3724)

  • INFO

    • Reads the machine GUID from the registry

      • UnCleaner.exe (PID: 3496)
      • wmpnscfg.exe (PID: 3644)
      • UnCleaner.exe (PID: 3724)

    • Checks supported languages

      • UnCleaner.exe (PID: 3496)
      • wmpnscfg.exe (PID: 3644)
      • UnCleaner.exe (PID: 3724)

    • Reads the computer name

      • UnCleaner.exe (PID: 3496)
      • wmpnscfg.exe (PID: 3644)
      • UnCleaner.exe (PID: 3724)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3644)
      • UnCleaner.exe (PID: 3776)
      • UnCleaner.exe (PID: 3724)

    • Reads Environment values

      • UnCleaner.exe (PID: 3496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:10:15 21:23:17+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 2400256
InitializedDataSize: 373760
UninitializedDataSize: -
EntryPoint: 0x24befa
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.7.0.0
ProductVersionNumber: 1.7.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: UnCleaner - The Unnecessary Files Cleaner Solution
CompanyName: Josh Cell Softwares
FileDescription: UnCleaner - The Unnecessary Files Cleaner Solution
FileVersion: 1.7.0.0
InternalName: LockedAssembly.exe
LegalCopyright: Copyright © Josh Cell Softwares Corporation. All Rights Reserved.
LegalTrademarks: Josh Cell Softwares Corporation
OriginalFileName: LockedAssembly.exe
ProductName: UnCleaner
ProductVersion: 1.7.0.0
AssemblyVersion: 1.7.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start uncleaner.exe wmpnscfg.exe no specs uncleaner.exe no specs uncleaner.exe uncleaner.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3428"C:\Users\admin\Desktop\UnCleaner.exe" C:\Users\admin\Desktop\UnCleaner.exe—explorer.exe
User:
admin
Company:
Josh Cell Softwares
Integrity Level:
MEDIUM
Description:
UnCleaner - The Unnecessary Files Cleaner Solution
Exit code:
3221226540
Version:
1.7.0.0
Modules
Images
c:\users\admin\desktop\uncleaner.exe
c:\windows\system32\ntdll.dll
3496"C:\Users\admin\Desktop\UnCleaner.exe" C:\Users\admin\Desktop\UnCleaner.exe
explorer.exe
User:
admin
Company:
Josh Cell Softwares
Integrity Level:
HIGH
Description:
UnCleaner - The Unnecessary Files Cleaner Solution
Exit code:
0
Version:
1.7.0.0
Modules
Images
c:\users\admin\desktop\uncleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3644"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3724"C:\Users\admin\Desktop\UnCleaner.exe" C:\Users\admin\Desktop\UnCleaner.exe
explorer.exe
User:
admin
Company:
Josh Cell Softwares
Integrity Level:
HIGH
Description:
UnCleaner - The Unnecessary Files Cleaner Solution
Exit code:
0
Version:
1.7.0.0
Modules
Images
c:\users\admin\desktop\uncleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3776"C:\Users\admin\Desktop\UnCleaner.exe" C:\Users\admin\Desktop\UnCleaner.exe—explorer.exe
User:
admin
Company:
Josh Cell Softwares
Integrity Level:
MEDIUM
Description:
UnCleaner - The Unnecessary Files Cleaner Solution
Exit code:
3221226540
Version:
1.7.0.0
Modules
Images
c:\users\admin\desktop\uncleaner.exe
c:\windows\system32\ntdll.dll
Total events
656
Read events
653
Write events
0
Delete events
3

Modification events

(PID) Process:(3644) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{20DF0E8F-1552-4A6B-BA9C-B14483F23FD4}\{04265770-31F1-411C-8AC1-2820E3341058}
Operation:delete keyName:(default)
Value:
(PID) Process:(3644) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{20DF0E8F-1552-4A6B-BA9C-B14483F23FD4}
Operation:delete keyName:(default)
Value:
(PID) Process:(3644) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7933BA41-5011-49C1-9B84-5DEF02367931}
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3496
UnCleaner.exe
GET
—
69.16.230.228:80
http://download.joshcellsoftwares.com/updstr
unknown
—
—
unknown
3496
UnCleaner.exe
GET
—
69.16.230.228:80
http://download.joshcellsoftwares.com/updstr
unknown
—
—
unknown
3496
UnCleaner.exe
GET
—
69.16.230.228:80
http://download.joshcellsoftwares.com/updstr
unknown
—
—
unknown
3496
UnCleaner.exe
GET
—
69.16.230.228:80
http://download.joshcellsoftwares.com/updstr
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
svchost.exe
95.101.148.135:80
armmf.adobe.com
Akamai International B.V.
NL
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3496
UnCleaner.exe
69.16.230.228:80
download.joshcellsoftwares.com
LIQUIDWEB
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
armmf.adobe.com
  • 95.101.148.135
whitelisted
download.joshcellsoftwares.com
  • 69.16.230.228
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UnCleaner.exe