File name:

smss.exe

Full analysis: https://app.any.run/tasks/e7178cb1-223c-4c4c-bcd5-bc45b4ef4c46
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Malware Trends Tracker     >>>
Analysis date: October 02, 2024, 07:31:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sality
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BB41CC4482459832FB282F68AE0CE5E9

SHA1:

6D5776BFD86AD32CEACE0C4B6391669E71B095B6

SHA256:

2C38E328E1597F8542E6ACAD39328FDDEF5ED6B11C1C5D86F20F9465520FA7B7

SSDEEP:

3072:/tKmbFed6S6e1GnuVCX1CykQ1bG6e4fj2A:ImbFes/e1G2GT4Qfj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 1296)
      • dllhost.exe (PID: 2836)
      • ctfmon.exe (PID: 1032)
      • taskeng.exe (PID: 280)
      • dwm.exe (PID: 460)
      • dllhost.exe (PID: 3224)
      • dllhost.exe (PID: 3540)

    • SALITY mutex has been found

      • explorer.exe (PID: 1296)
      • smss.exe (PID: 3744)
      • ctfmon.exe (PID: 1032)
      • dwm.exe (PID: 460)
      • dllhost.exe (PID: 2836)
      • taskeng.exe (PID: 280)
      • dllhost.exe (PID: 3540)
      • dllhost.exe (PID: 3224)
      • WINWORD.EXE (PID: 3284)

    • Runs injected code in another process

      • smss.exe (PID: 3744)

    • Changes appearance of the Explorer extensions

      • smss.exe (PID: 3744)

    • Changes Security Center notification settings

      • smss.exe (PID: 3744)

    • UAC/LUA settings modification

      • smss.exe (PID: 3744)

    • Connects to the CnC server

      • smss.exe (PID: 3744)

    • SALITY has been detected (SURICATA)

      • smss.exe (PID: 3744)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • smss.exe (PID: 3744)

    • Reads security settings of Internet Explorer

      • smss.exe (PID: 3744)

    • Reads the Internet Settings

      • smss.exe (PID: 3744)

    • Contacting a server suspected of hosting an CnC

      • smss.exe (PID: 3744)

    • Reads settings of System Certificates

      • smss.exe (PID: 3744)

    • Creates file in the systems drive root

      • smss.exe (PID: 3744)

    • Checks Windows Trust Settings

      • smss.exe (PID: 3744)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1296)

    • Checks supported languages

      • smss.exe (PID: 3744)
      • wmpnscfg.exe (PID: 1044)
      • wmpnscfg.exe (PID: 2436)

    • The process uses the downloaded file

      • explorer.exe (PID: 1296)
      • WINWORD.EXE (PID: 3284)

    • Reads the computer name

      • smss.exe (PID: 3744)
      • wmpnscfg.exe (PID: 1044)
      • wmpnscfg.exe (PID: 2436)

    • Create files in a temporary directory

      • smss.exe (PID: 3744)

    • UPX packer has been detected

      • smss.exe (PID: 3744)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1044)
      • WINWORD.EXE (PID: 3284)
      • wmpnscfg.exe (PID: 2436)

    • Checks proxy server information

      • smss.exe (PID: 3744)
      • dllhost.exe (PID: 3224)

    • Reads the machine GUID from the registry

      • smss.exe (PID: 3744)

    • Reads the software policy settings

      • smss.exe (PID: 3744)

    • Reads the Internet Settings

      • explorer.exe (PID: 1296)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 1296)

    • Creates files or folders in the user directory

      • smss.exe (PID: 3744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:12:28 19:22:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 3072
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x16000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
11
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY smss.exe wmpnscfg.exe no specs #SALITY winword.exe no specs #SALITY thumbnail cache out of proc server #SALITY wininetbrokerserver wmpnscfg.exe no specs #SALITY taskeng.exe #SALITY dwm.exe #SALITY ctfmon.exe #SALITY explorer.exe #SALITY dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
280taskeng.exe {8F81F50F-8A56-43F4-81CA-1E996579EDDB}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
460"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1032C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1044"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2436"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2836C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3224C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3284"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\meettoys.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3540C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 452
Read events
10 752
Write events
379
Delete events
321

Modification events

(PID) Process:(3744) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:FirewallDisableNotify
Value:
1
Executable files
1
Suspicious files
17
Text files
12
Unknown types
6

Dropped files

PID
Process
Filename
Type
3284WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRCCE6.tmp.cvr —
MD5:—
SHA256:—
3744smss.exeC:\Users\admin\AppData\Local\Temp\mpaiho.exeexecutable
MD5:25AA9BB549ECC7BB6100F8D179452508
SHA256:DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
3284WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:4E2FDB6D8B29D038A386ECEABA882E57
SHA256:40A2ACED0CF44E16365B0D1EFDB979DEE94A533F83EFEF82B6AA1C61E7C478C9
3284WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{108A6B8D-278A-4A06-9F84-DD26FDBB9206}.tmpbinary
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
3744smss.exeC:\Users\admin\AppData\Local\Temp\cxvgw.exehtml
MD5:CAD87123E7548F5B299435C792CA4F94
SHA256:151E80AE3D19061E9FC87286A03A8DAB09EA4A119F9D8D85731123996F35918A
1296explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\meettoys.rtf (2).lnklnk
MD5:F9D9B85DF12489BA326845101C2E290E
SHA256:83FB2755A962BAE8538F50D0D07DC5D905B51D30D874983394291EF4AD59CE4A
3284WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:DF95C347EFD6EFAB2C97C18DC119BC55
SHA256:33EF7E5725F444C7A00AC5FC9B198B6441DF4A6694AE8926C95F90073323AE87
3284WINWORD.EXEC:\Users\admin\Desktop\~$ettoys.rtfbinary
MD5:20766077D1E1CB9BF9E4F09D824344A5
SHA256:D08A296EB2BB67F573DB345B9E8807A6F95417DBB1A2EDA9CF8A9F6D939A91A4
1296explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:1409034F7D4C9CE59480884C105CEB45
SHA256:E4E6832D2DBC5406E108770901E7CCFFADD75D3DEA5911677C0EBBDB8308A52E
3284WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{2FD6F1FE-0B04-4DD3-BECD-821704911C1B}.tmpbinary
MD5:953007AF5161252E949788DE2246A7C1
SHA256:355F986DAA6566317AF8036690350BD0290ABD4EE60D934D289DF0B18662B579
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
28
DNS requests
23
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3744
smss.exe
GET
503
202.45.144.21:80
http://doasoil.gov.np/images/logo.gif?25d201=17350151
unknown
—
—
malicious
3744
smss.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a0c822bf00edce7
unknown
—
—
whitelisted
3744
smss.exe
GET
301
27.254.137.12:80
http://cmyj.co.th/images/logo.gif?25e1d0=12413200
unknown
—
—
malicious
3744
smss.exe
GET
200
184.25.51.75:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgQnzjN6mS%2BSsjzA%2BHCS1o6yzg%3D%3D
unknown
—
—
whitelisted
3744
smss.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3744
smss.exe
GET
301
202.129.205.27:80
http://chonkanya.ac.th/images/logo.gif?25f038=7458984
unknown
—
—
malicious
3744
smss.exe
GET
404
202.129.205.27:80
http://www.chonkanya.ac.th/images/logo.gif?25f038=7458984
unknown
—
—
malicious
3744
smss.exe
GET
302
45.33.2.79:80
http://aniketkulkarni.in/images/logo.gif?264666=22575510
unknown
—
—
malicious
3744
smss.exe
GET
522
172.67.174.122:80
http://dinamikdekor.com/images/logof.gif?25f8e2=4977092
unknown
—
—
malicious
3744
smss.exe
GET
200
108.138.2.10:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3744
smss.exe
202.45.144.21:80
doasoil.gov.np
NITC: IT Agency of Government of Nepal
NP
malicious
3744
smss.exe
27.254.137.12:80
cmyj.co.th
CS LOXINFO Public Company Limited.
TH
malicious
3744
smss.exe
27.254.137.12:443
cmyj.co.th
CS LOXINFO Public Company Limited.
TH
malicious
3744
smss.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
3744
smss.exe
72.246.169.163:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
doasoil.gov.np
  • 202.45.144.21
malicious
earnestbiz.com
  • —
unknown
fotozenistanbul.com
  • —
unknown
cmyj.co.th
  • 27.254.137.12
malicious
www.cmyj.co.th
  • 27.254.137.12
unknown
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
e6.o.lencr.org
  • 184.25.51.75
  • 184.25.51.82
whitelisted
chonkanya.ac.th
  • 202.129.205.27
malicious

Threats

PID
Process
Class
Message
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
smss.exe