URL:

https://github.com/bill-zhanxg/NoEscape.exe-Download/tree/main/NoEscape.exe

Full analysis: https://app.any.run/tasks/5ba4f1a7-b252-4b78-bb7b-7af505c59220
Verdict: Malicious activity
Analysis date: February 11, 2022, 21:00:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E91F3FA192567EF5B7FB88847994A248

SHA1:

02B1D9F82766A1641880060F8C1DB94C9E94C6D9

SHA256:

DDAE4987DFC8FA45F03A363B64D3662A5DC9D71DCC70117A85A6BAB9CEE88525

SSDEEP:

3:N8tEd3IxLvrKgX2FEE8GQRKe+J:2uCNXX2zTQRK/J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NoEscape.exe (PID: 992)
      • NoEscape.exe (PID: 576)
      • NoEscape.exe (PID: 2996)
      • NoEscape.exe (PID: 1932)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3480)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 2868)

    • Reads the computer name

      • NoEscape.exe (PID: 992)
      • NoEscape.exe (PID: 2996)

    • Checks supported languages

      • NoEscape.exe (PID: 992)
      • NoEscape.exe (PID: 576)
      • NoEscape.exe (PID: 2996)
      • NoEscape.exe (PID: 1932)

    • Application launched itself

      • NoEscape.exe (PID: 992)
      • NoEscape.exe (PID: 2996)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2868)
      • iexplore.exe (PID: 3480)
      • explorer.exe (PID: 2472)

    • Application launched itself

      • iexplore.exe (PID: 2868)

    • Checks supported languages

      • iexplore.exe (PID: 2868)
      • iexplore.exe (PID: 3480)
      • explorer.exe (PID: 2472)

    • Changes internet zones settings

      • iexplore.exe (PID: 2868)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2868)
      • iexplore.exe (PID: 3480)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 2868)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3480)

    • Creates files in the user directory

      • iexplore.exe (PID: 3480)
      • iexplore.exe (PID: 2868)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2868)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2868)

    • Manual execution by user

      • NoEscape.exe (PID: 2996)
      • explorer.exe (PID: 2472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe noescape.exe no specs noescape.exe explorer.exe no specs noescape.exe no specs noescape.exe

Process information

PID
CMD
Path
Indicators
Parent process
576"C:\Users\admin\Downloads\NoEscape.exe" C:\Users\admin\Downloads\NoEscape.exe
NoEscape.exe
User:
admin
Company:
Endermanch
Integrity Level:
HIGH
Description:
Windows Customization Tool
Exit code:
0
Version:
6.6.6.6
992"C:\Users\admin\Downloads\NoEscape.exe" C:\Users\admin\Downloads\NoEscape.exe—iexplore.exe
User:
admin
Company:
Endermanch
Integrity Level:
MEDIUM
Description:
Windows Customization Tool
Exit code:
0
Version:
6.6.6.6
1932"C:\Users\admin\Downloads\NoEscape.exe" C:\Users\admin\Downloads\NoEscape.exe
NoEscape.exe
User:
admin
Company:
Endermanch
Integrity Level:
HIGH
Description:
Windows Customization Tool
Exit code:
0
Version:
6.6.6.6
2472"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2868"C:\Program Files\Internet Explorer\iexplore.exe" "https://github.com/bill-zhanxg/NoEscape.exe-Download/tree/main/NoEscape.exe"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2996"C:\Users\admin\Downloads\NoEscape.exe" C:\Users\admin\Downloads\NoEscape.exe—Explorer.EXE
User:
admin
Company:
Endermanch
Integrity Level:
MEDIUM
Description:
Windows Customization Tool
Exit code:
0
Version:
6.6.6.6
3480"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2868 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
18
Text files
29
Unknown types
11

Dropped files

PID
Process
Filename
Type
2868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:—
SHA256:—
2868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1der
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_D0FA13DADFB59BDF00C474952E166CC1binary
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3der
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12B578593FDE07EC53D020B1D5DEBF3B_5D74C2DB556F94499BCD6D74A36958A3binary
MD5:—
SHA256:—
2868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:—
SHA256:—
3480iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3480
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTGMlruL6P9M9B3if1rTM7wyj%2FQKQQUUGGmoNI1xBEqII0fD6xC8M0pz0sCEA6L83cNktGW8Lth%2BTxBZr4%3D
US
der
279 b
whitelisted
3480
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2868
iexplore.exe
GET
200
8.241.9.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a55319b5e67b1851
US
compressed
4.70 Kb
whitelisted
3480
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2868
iexplore.exe
GET
200
8.241.9.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4a254c5d343e8325
US
compressed
4.70 Kb
whitelisted
3480
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAZnA1u7FP1jr8DWqFNO%2FhY%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2868
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3480
iexplore.exe
140.82.121.4:443
github.com
—
US
malicious
2868
iexplore.exe
8.241.9.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2868
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3480
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3480
iexplore.exe
185.199.108.154:443
github.githubassets.com
GitHub, Inc.
NL
suspicious
2868
iexplore.exe
185.199.108.154:443
github.githubassets.com
GitHub, Inc.
NL
suspicious
3480
iexplore.exe
185.199.110.133:443
avatars.githubusercontent.com
GitHub, Inc.
NL
malicious
2868
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3480
iexplore.exe
185.199.108.133:443
avatars.githubusercontent.com
GitHub, Inc.
NL
malicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
ctldl.windowsupdate.com
  • 8.241.9.254
  • 8.248.145.254
  • 67.27.157.126
  • 8.248.135.254
  • 8.248.149.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
github.githubassets.com
  • 185.199.108.154
  • 185.199.109.154
  • 185.199.110.154
  • 185.199.111.154
whitelisted
avatars.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
whitelisted
github-cloud.s3.amazonaws.com
  • 52.217.79.124
  • 52.217.37.100
shared
user-images.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/bill-zhanxg/NoEscape.exe-Download/tree/main/NoEscape.exe