Find similar analyses in TI Lookup

Analysis date (UTC): 11 February 2022, 21:00Analysis environment: Windows 7 Pro, build 7601, x86

https://github.com/bill-zhanxg/NoEscape.exe-Download/tree/main/NoEscape.exe

MD5:E91F3FA192567EF5B7FB88847994A248

SHA1:02B1D9F82766A1641880060F8C1DB94C9E94C6D9

SHA256:DDAE4987DFC8FA45F03A363B64D3662A5DC9D71DCC70117A85A6BAB9CEE88525

Analysis result

Threat level:Malicious activity

Full analysis:Analysis https://github.com/bill-zhanxg/NoEscape.exe-Download/tree/main/NoEscape.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

NoEscape.exe (PID: 992)
NoEscape.exe (PID: 576)
NoEscape.exe (PID: 2996)
NoEscape.exe (PID: 1932)

SUSPICIOUS

Reads Microsoft Outlook installation path

iexplore.exe (PID: 3480)

Executable content was dropped or overwritten

iexplore.exe (PID: 2868)
iexplore.exe (PID: 3480)

Checks supported languages

NoEscape.exe (PID: 992)
NoEscape.exe (PID: 576)
NoEscape.exe (PID: 2996)
NoEscape.exe (PID: 1932)

Reads the computer name

NoEscape.exe (PID: 992)
NoEscape.exe (PID: 2996)

Application launched itself

NoEscape.exe (PID: 992)
NoEscape.exe (PID: 2996)

INFO

Checks Windows Trust Settings

iexplore.exe (PID: 2868)
iexplore.exe (PID: 3480)

Reads the computer name

iexplore.exe (PID: 3480)
iexplore.exe (PID: 2868)
explorer.exe (PID: 2472)

Checks supported languages

iexplore.exe (PID: 2868)
iexplore.exe (PID: 3480)
explorer.exe (PID: 2472)

Application launched itself

iexplore.exe (PID: 2868)

Changes internet zones settings

iexplore.exe (PID: 2868)

Reads internet explorer settings

iexplore.exe (PID: 3480)

Reads settings of System Certificates

iexplore.exe (PID: 2868)
iexplore.exe (PID: 3480)

Modifies the phishing filter of IE

iexplore.exe (PID: 2868)

Creates files in the user directory

iexplore.exe (PID: 3480)
iexplore.exe (PID: 2868)

Manual execution by user

explorer.exe (PID: 2472)
NoEscape.exe (PID: 2996)

Reads the date of Windows installation

iexplore.exe (PID: 2868)

Threats

No threats detected