Analysis date (UTC): 1 January 2019, 13:26Analysis environment: Windows 7 Pro, build 7601, x86

http://cdn.superantispyware.com/SUPERAntiSpyware.exe

MD5:CEBC0558BFA25E331E56CB86BF7A6286

SHA1:9326EBDD598E1A6D873D6A06BC8993D53224F1DE

SHA256:21F2A7C9DD326DE2AF5426F2E4750938A74E3B8A92576763E596DA325CDA35AE

Analysis result

Threat level:Malicious activity

Tags:

loader

Full analysis:Analysis http://cdn.superantispyware.com/SUPERAntiSpyware.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Downloads executable files from the Internet

iexplore.exe (PID: 3388)

Loads dropped or rewritten executable

SUPERAntiSpyware[1].exe (PID: 2236)
REGSVR32.EXE (PID: 2832)
SASCORE.EXE (PID: 2292)

Application was dropped or rewritten from another process

SASCORE.EXE (PID: 2292)
SUPERAntiSpyware.exe (PID: 3768)
SASCORE.EXE (PID: 3268)
SSUPDATE.EXE (PID: 2960)
sas_enum_cookies.exe (PID: 1888)

Registers / Runs the DLL via REGSVR32.EXE

SUPERAntiSpyware[1].exe (PID: 2236)

Loads the Task Scheduler DLL interface

SUPERAntiSpyware.exe (PID: 3768)

Loads the Task Scheduler COM API

SUPERAntiSpyware.exe (PID: 3768)

Changes the autorun value in the registry

SASCORE.EXE (PID: 2292)

SUSPICIOUS

Application launched itself

SUPERAntiSpyware[1].exe (PID: 1820)

Executable content was dropped or overwritten

SUPERAntiSpyware[1].exe (PID: 2236)

Creates files in the program directory

SUPERAntiSpyware[1].exe (PID: 1820)
SUPERAntiSpyware[1].exe (PID: 2236)
SASCORE.EXE (PID: 2292)
SUPERAntiSpyware.exe (PID: 3768)

Creates or modifies windows services

SASCORE.EXE (PID: 3268)
SUPERAntiSpyware[1].exe (PID: 2236)

Creates COM task schedule object

REGSVR32.EXE (PID: 2832)

Creates files in the user directory

SUPERAntiSpyware[1].exe (PID: 2236)
SUPERAntiSpyware.exe (PID: 3768)

Creates a software uninstall entry

SUPERAntiSpyware[1].exe (PID: 2236)

Creates files in the Windows directory

SUPERAntiSpyware.exe (PID: 3768)

Reads Internet Cache Settings

sas_enum_cookies.exe (PID: 1888)

Reads the cookies of Google Chrome

SUPERAntiSpyware.exe (PID: 3768)

Reads the cookies of Mozilla Firefox

SUPERAntiSpyware.exe (PID: 3768)

INFO

Reads Internet Cache Settings

iexplore.exe (PID: 3388)

Changes internet zones settings

iexplore.exe (PID: 2836)

Application launched itself

iexplore.exe (PID: 2836)

Dropped object may contain Bitcoin addresses

SUPERAntiSpyware[1].exe (PID: 2236)
SUPERAntiSpyware.exe (PID: 3768)

Threats

PID	Process	Class	Message
3388	iexplore.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP