File name:

smss.exe

Full analysis: https://app.any.run/tasks/e7178cb1-223c-4c4c-bcd5-bc45b4ef4c46
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Malware Trends Tracker     >>>
Analysis date: October 02, 2024, 07:31:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
sality
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BB41CC4482459832FB282F68AE0CE5E9

SHA1:

6D5776BFD86AD32CEACE0C4B6391669E71B095B6

SHA256:

2C38E328E1597F8542E6ACAD39328FDDEF5ED6B11C1C5D86F20F9465520FA7B7

SSDEEP:

3072:/tKmbFed6S6e1GnuVCX1CykQ1bG6e4fj2A:ImbFes/e1G2GT4Qfj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • taskeng.exe (PID: 280)
      • dwm.exe (PID: 460)
      • explorer.exe (PID: 1296)
      • dllhost.exe (PID: 2836)
      • ctfmon.exe (PID: 1032)
      • dllhost.exe (PID: 3540)
      • dllhost.exe (PID: 3224)

    • SALITY mutex has been found

      • smss.exe (PID: 3744)
      • explorer.exe (PID: 1296)
      • ctfmon.exe (PID: 1032)
      • dwm.exe (PID: 460)
      • dllhost.exe (PID: 2836)
      • taskeng.exe (PID: 280)
      • WINWORD.EXE (PID: 3284)
      • dllhost.exe (PID: 3540)
      • dllhost.exe (PID: 3224)

    • Runs injected code in another process

      • smss.exe (PID: 3744)

    • Changes appearance of the Explorer extensions

      • smss.exe (PID: 3744)

    • UAC/LUA settings modification

      • smss.exe (PID: 3744)

    • Changes Security Center notification settings

      • smss.exe (PID: 3744)

    • SALITY has been detected (SURICATA)

      • smss.exe (PID: 3744)

    • Connects to the CnC server

      • smss.exe (PID: 3744)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • smss.exe (PID: 3744)

    • Executable content was dropped or overwritten

      • smss.exe (PID: 3744)

    • Reads security settings of Internet Explorer

      • smss.exe (PID: 3744)

    • Reads the Internet Settings

      • smss.exe (PID: 3744)

    • Contacting a server suspected of hosting an CnC

      • smss.exe (PID: 3744)

    • Checks Windows Trust Settings

      • smss.exe (PID: 3744)

    • Reads settings of System Certificates

      • smss.exe (PID: 3744)

  • INFO

    • The process uses the downloaded file

      • explorer.exe (PID: 1296)
      • WINWORD.EXE (PID: 3284)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1296)

    • Checks supported languages

      • smss.exe (PID: 3744)
      • wmpnscfg.exe (PID: 1044)
      • wmpnscfg.exe (PID: 2436)

    • Reads the computer name

      • smss.exe (PID: 3744)
      • wmpnscfg.exe (PID: 1044)
      • wmpnscfg.exe (PID: 2436)

    • Create files in a temporary directory

      • smss.exe (PID: 3744)

    • UPX packer has been detected

      • smss.exe (PID: 3744)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1044)
      • WINWORD.EXE (PID: 3284)
      • wmpnscfg.exe (PID: 2436)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 1296)

    • Reads the Internet Settings

      • explorer.exe (PID: 1296)

    • Checks proxy server information

      • smss.exe (PID: 3744)
      • dllhost.exe (PID: 3224)

    • Reads the machine GUID from the registry

      • smss.exe (PID: 3744)

    • Reads the software policy settings

      • smss.exe (PID: 3744)

    • Creates files or folders in the user directory

      • smss.exe (PID: 3744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:12:28 19:22:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 3072
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x16000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
11
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY smss.exe wmpnscfg.exe no specs #SALITY winword.exe no specs #SALITY thumbnail cache out of proc server #SALITY wininetbrokerserver wmpnscfg.exe no specs #SALITY taskeng.exe #SALITY dwm.exe #SALITY ctfmon.exe #SALITY explorer.exe #SALITY dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
280taskeng.exe {8F81F50F-8A56-43F4-81CA-1E996579EDDB}C:\Windows\System32\taskeng.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Engine
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskeng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
460"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1032C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1044"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2436"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2836C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3224C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3284"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\meettoys.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3540C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 452
Read events
10 752
Write events
379
Delete events
321

Modification events

(PID) Process:(3744) smss.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
2
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(3744) smss.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
Operation:writeName:FirewallDisableNotify
Value:
1
Executable files
1
Suspicious files
17
Text files
12
Unknown types
6

Dropped files

PID
Process
Filename
Type
3284WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRCCE6.tmp.cvr —
MD5:—
SHA256:—
3744smss.exeC:\Windows\system.inibinary
MD5:6F435D1A3C2BA5A422A2F2AE9362E4EA
SHA256:57751E3123014D2774AA52F7C8E09055F562B7329E06F60B139C10C6A48F88DB
3744smss.exeC:\Users\admin\AppData\Local\Temp\mpaiho.exeexecutable
MD5:25AA9BB549ECC7BB6100F8D179452508
SHA256:DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
1296explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\a7bd71699cd38d1c.automaticDestinations-msautomaticdestinations-ms
MD5:4C0F01217BBFD58604F4B7FB50C4A776
SHA256:4E8ED3E727CB294FA9B152A7CCD7BF585E390CCFC5D6C420E816F2C0A80B9AC6
3284WINWORD.EXEC:\Users\admin\Desktop\~$ettoys.rtfbinary
MD5:20766077D1E1CB9BF9E4F09D824344A5
SHA256:D08A296EB2BB67F573DB345B9E8807A6F95417DBB1A2EDA9CF8A9F6D939A91A4
3284WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4AEDEE7E-E9F8-436F-8991-AA5DC65081F1}.tmpdbf
MD5:D7F5B24170E484B6C8E1D18042808605
SHA256:A2FFCB6394219BE657BB7EB6FC81AA7EBB1038129370160B4E5DB9DADAFAF209
3744smss.exeC:\Users\admin\AppData\Local\Temp\winepwpi.exehtml
MD5:260F503A9B566B428395B6E0E494EE83
SHA256:75124407CBA048B94D1BFFDD3F1677DE20765C99E845A9D2EDE4334163DC646E
3744smss.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:77CC84FE81D51E3FE1BB654D9A9DF148
SHA256:0B2F35341DF104B1169C13A5808CFBBB79F795E85D8C95909CF246D91E1AB2BF
1296explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\meettoys.rtf (2).lnklnk
MD5:F9D9B85DF12489BA326845101C2E290E
SHA256:83FB2755A962BAE8538F50D0D07DC5D905B51D30D874983394291EF4AD59CE4A
3284WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:4E2FDB6D8B29D038A386ECEABA882E57
SHA256:40A2ACED0CF44E16365B0D1EFDB979DEE94A533F83EFEF82B6AA1C61E7C478C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
28
DNS requests
23
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3744
smss.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a0c822bf00edce7
US
—
—
whitelisted
3744
smss.exe
GET
503
202.45.144.21:80
http://doasoil.gov.np/images/logo.gif?25d201=17350151
NP
html
6.67 Kb
malicious
3744
smss.exe
GET
301
27.254.137.12:80
http://cmyj.co.th/images/logo.gif?25e1d0=12413200
TH
html
262 b
malicious
3744
smss.exe
GET
200
184.25.51.75:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgQnzjN6mS%2BSsjzA%2BHCS1o6yzg%3D%3D
DE
binary
346 b
whitelisted
3744
smss.exe
GET
301
202.129.205.27:80
http://chonkanya.ac.th/images/logo.gif?25f038=7458984
TH
—
—
malicious
3744
smss.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
DE
binary
717 b
whitelisted
3744
smss.exe
GET
404
202.129.205.27:80
http://www.chonkanya.ac.th/images/logo.gif?25f038=7458984
TH
html
16.7 Kb
malicious
3744
smss.exe
GET
302
45.33.2.79:80
http://aniketkulkarni.in/images/logo.gif?264666=22575510
US
—
—
malicious
3744
smss.exe
GET
522
172.67.174.122:80
http://dinamikdekor.com/images/logof.gif?25f8e2=4977092
US
text
15 b
malicious
3744
smss.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
binary
1.49 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3744
smss.exe
202.45.144.21:80
doasoil.gov.np
NITC: IT Agency of Government of Nepal
NP
malicious
3744
smss.exe
27.254.137.12:80
cmyj.co.th
CS LOXINFO Public Company Limited.
TH
malicious
3744
smss.exe
27.254.137.12:443
cmyj.co.th
CS LOXINFO Public Company Limited.
TH
malicious
3744
smss.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
3744
smss.exe
72.246.169.163:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
doasoil.gov.np
  • 202.45.144.21
malicious
earnestbiz.com
  • —
unknown
fotozenistanbul.com
  • —
unknown
cmyj.co.th
  • 27.254.137.12
malicious
www.cmyj.co.th
  • 27.254.137.12
unknown
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
e6.o.lencr.org
  • 184.25.51.75
  • 184.25.51.82
whitelisted
chonkanya.ac.th
  • 202.129.205.27
malicious

Threats

PID
Process
Class
Message
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
3744
smss.exe
Malware Command and Control Activity Detected
ET MALWARE Win32.Sality-GR Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
smss.exe