File name:

Samsung HDD Repair Tool.exe

Full analysis: https://app.any.run/tasks/b977a6d3-7a60-47d3-b2b4-d72f25981051
Verdict: Malicious activity
Analysis date: January 23, 2024, 23:36:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

79CED9862AB7D2D97D9D74DA7A57449C

SHA1:

A0C6F7DA8A15FBB9E03F4675378F4B8DE9576877

SHA256:

2449A5DF853AC752F2509B06037A475559F7BE4101CEE155E2151C874964FDAE

SSDEEP:

49152:CrReRXWJtgBHWvFt9Jnf82KRNG5LtHqXckgUryPxUOM52n7vOg2BoChy6fIaibuH:CleRSS/nY7M5wH2BU6fInbuT/urAi28O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Samsung HDD Repair Tool.exe (PID: 2568)
      • Samsung HDD Repair Tool.exe (PID: 3008)

    • Creates a writable file in the system directory

      • Samsung HDD Repair Tool.exe (PID: 3008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Samsung HDD Repair Tool.exe (PID: 2568)
      • Samsung HDD Repair Tool.exe (PID: 3008)

    • Drops a system driver (possible attempt to evade defenses)

      • Samsung HDD Repair Tool.exe (PID: 2568)
      • Samsung HDD Repair Tool.exe (PID: 3008)

    • Creates files in the driver directory

      • Samsung HDD Repair Tool.exe (PID: 3008)

  • INFO

    • Checks supported languages

      • Samsung HDD Repair Tool.exe (PID: 2568)
      • Samsung HDD Repair Tool.exe (PID: 3008)

    • Create files in a temporary directory

      • Samsung HDD Repair Tool.exe (PID: 2568)

    • Reads the computer name

      • Samsung HDD Repair Tool.exe (PID: 2568)
      • Samsung HDD Repair Tool.exe (PID: 3008)

    • Manual execution by a user

      • explorer.exe (PID: 2588)
      • explorer.exe (PID: 2928)
      • Samsung HDD Repair Tool.exe (PID: 3008)
      • verclsid.exe (PID: 2064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.42
CodeSize: 16384
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x4202390
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start samsung hdd repair tool.exe explorer.exe no specs verclsid.exe no specs explorer.exe no specs samsung hdd repair tool.exe

Process information

PID
CMD
Path
Indicators
Parent process
2064"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401C:\Windows\System32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\verclsid.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2568"C:\Users\admin\AppData\Local\Temp\Samsung HDD Repair Tool.exe" C:\Users\admin\AppData\Local\Temp\Samsung HDD Repair Tool.exe
explorer.exe
User:
admin
Company:
HDD Soft
Integrity Level:
MEDIUM
Description:
HDD Repair Tool
Exit code:
0
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\samsung hdd repair tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
2588"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2928"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3008"C:\Users\admin\AppData\Local\Temp\Samsung HDD Repair Tool.exe" C:\Users\admin\AppData\Local\Temp\Samsung HDD Repair Tool.exe
explorer.exe
User:
admin
Company:
HDD Soft
Integrity Level:
HIGH
Description:
HDD Repair Tool
Exit code:
0
Version:
3.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\samsung hdd repair tool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\psapi.dll
Total events
157
Read events
157
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3008Samsung HDD Repair Tool.exeC:\Windows\system32\Drivers\PortTalk.sysexecutable
MD5:7D5A2D755B6C6579F63657B527D6FF1B
SHA256:A2B44785FA6BE4A2A723B06B906F6C48DEAD63ACC0F787CF9A0890EED47F9D0C
2568Samsung HDD Repair Tool.exeC:\Users\admin\AppData\Local\Temp\PORTTALK.SYSexecutable
MD5:7D5A2D755B6C6579F63657B527D6FF1B
SHA256:A2B44785FA6BE4A2A723B06B906F6C48DEAD63ACC0F787CF9A0890EED47F9D0C
2568Samsung HDD Repair Tool.exeC:\Users\admin\AppData\Local\Temp\Samsung.initext
MD5:0B975CCA5395390F4DE1DBDD49EA566C
SHA256:E13A3F1810D2D836DF1A7A72481E721E6FC13CFC337A74C746CAADBE3CA91BC2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Samsung HDD Repair Tool.exe
%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Samsung HDD Repair Tool.exe