File name:

SamsungFrp2020.exe

Full analysis: https://app.any.run/tasks/f3e72a49-b273-4a92-9729-3000a6c1efcf
Verdict: Malicious activity
Analysis date: June 25, 2023, 18:47:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

258E7698054FC8EAF934C7E03FC96E9E

SHA1:

0ED5251DE551C42A04F09153C7A1970D16CE2E87

SHA256:

7CFDF65B1F93BD600A4E7CADBCFECCC634D0C34B5B098740AF1CF2AFA7C64B97

SSDEEP:

98304:k2io0F6n4DKhOPqSUze/aEO0j514bP35GB2sB9mqq3zY+WziaHLwU9S2iZtJ:kA0pD8OPqZx0z64rB/8CiaHEU9SZtJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads settings of System Certificates

      • SamsungFrp2020.exe (PID: 3660)

    • Reads the Internet Settings

      • SamsungFrp2020.exe (PID: 3660)

  • INFO

    • The process checks LSA protection

      • SamsungFrp2020.exe (PID: 3660)

    • Checks supported languages

      • SamsungFrp2020.exe (PID: 3660)

    • Reads the computer name

      • SamsungFrp2020.exe (PID: 3660)

    • Reads the machine GUID from the registry

      • SamsungFrp2020.exe (PID: 3660)

    • Application launched itself

      • iexplore.exe (PID: 1788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | DOS Executable Generic (100)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x1001000
UninitializedDataSize: -
InitializedDataSize: 6723072
CodeSize: 10220032
LinkerVersion: 14.16
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2020:10:03 16:16:20+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 03-Oct-2020 16:16:20
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0xCCCF
Pages in file: 0xED78
Relocations: 0xB8F5
Size of header: 0xA76F
Min extra paragraphs: 0xF05F
Max extra paragraphs: 0x9DA4
Initial SS value: 0xF6CE
Initial SP value: 0x54CA
Checksum: 0x01AA
Initial IP value: 0xE999
Initial CS value: 0xE04F
Overlay number: 0xA079
OEM identifier: 0xEE16
OEM information: 0x56FA
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 03-Oct-2020 16:16:20
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
0x01001000
0x0001A000
0x00019B07
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99735
.rsrc
0x00FDE000
0x000212CC
0x000212CC
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.34465

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.88996
387
UNKNOWN
English - United States
RT_MANIFEST
2
5.24446
67624
UNKNOWN
English - United States
RT_ICON
3
5.58606
16936
UNKNOWN
English - United States
RT_ICON
4
5.82179
9640
UNKNOWN
English - United States
RT_ICON
5
6.02284
4264
UNKNOWN
English - United States
RT_ICON
6
6.24286
1128
UNKNOWN
English - United States
RT_ICON
46600
7.21291
299
UNKNOWN
UNKNOWN
RT_RCDATA
IDI_ICON1
2.79908
90
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

advapi32.dll
comctl32.dll
kernel32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start samsungfrp2020.exe iexplore.exe iexplore.exe samsungfrp2020.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1788"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwi5lObcypTsAhVh-yoKHRUeAHIQFjAPegQICBAC&url=https%3A%2F%2Feasy-firmware.com%2Findex.php%3Fa%3Ddownloads%26b%3Dfolder%26id%3D5691&usg=AOvVaw1nTDxuCisH83j8a8AgvYGaC:\Program Files\Internet Explorer\iexplore.exe
SamsungFrp2020.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2240"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1788 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3096"C:\Users\admin\AppData\Local\Temp\SamsungFrp2020.exe" C:\Users\admin\AppData\Local\Temp\SamsungFrp2020.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\samsungfrp2020.exe
c:\windows\system32\ntdll.dll
3660"C:\Users\admin\AppData\Local\Temp\SamsungFrp2020.exe" C:\Users\admin\AppData\Local\Temp\SamsungFrp2020.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\samsungfrp2020.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
19 110
Read events
18 982
Write events
127
Delete events
1

Modification events

(PID) Process:(3660) SamsungFrp2020.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1788) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
0
Suspicious files
50
Text files
82
Unknown types
0

Dropped files

PID
Process
Filename
Type
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AA62F8CE77E072C8160C71B5DF3099B0
SHA256:3EB4927C4D9097DC924FCDE21B56D01D5D1EF61B7D22BFB6786E3B546B33E176
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:B06B47D2896FDA1127A1A478556559FA
SHA256:F4A89F0458A9917A193C0D9AD067303C4810184711502DA9E7103670A98EE1AC
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30BCF8D79B1225AC4F40686E58D30D95binary
MD5:D0D9589C4266BE062C589B5AD3F9CB14
SHA256:9615700CFE24D572D7EE92F119B1A449793C847B11A2E9B9B9315DEBCD5D1185
2240iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\MQUZX72V.txttext
MD5:93F7670C984415BD689BE89B63F8D1D1
SHA256:1E9CE09AD62415B2B8AC06F2B18B25186E373BBF40A7CC790D1387EABCF4190C
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:4079B657E9BB33B6627AD756A1BC64EB
SHA256:C78F59CDE7D0EBF69A049B6831D10B6C40A9146CF932ADB0EF0CC5C6CFF52F56
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30BCF8D79B1225AC4F40686E58D30D95binary
MD5:6444E4485DC73FD5385C0E69D7B8E7B8
SHA256:C631EB0A49A82D19FE4B5227583CB1DB6AC8CFB65CBA6C379B0FDD3511B0D833
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:0A809B87976CB9BE1F150FDFE21AD6C0
SHA256:91FC958C3132F811FBD43BA5BD47820BE30AFD71FF657902AEBF6A4095DFFB61
2240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B00D8FAC34A9B3D508B6045AEF4829DD
SHA256:96E03E5F6E20F39165E095A9C89D55CD770F0422605839BE4B83289902957E18
2240iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\5KNN5B42.txttext
MD5:E2CE83915A4504F49C9C1D4F9E133DE0
SHA256:29CA22762B8FD00D5BC4D1E44C2AAC2354AF72831ADF62BD2645CD60A55D17B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
59
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2240
iexplore.exe
GET
—
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDvWzeNIHPI5AnIjF4SMdR6
US
—
—
whitelisted
2240
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
binary
724 b
whitelisted
2240
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d556fc7d578881e7
US
compressed
4.70 Kb
whitelisted
2240
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
binary
1.41 Kb
whitelisted
2240
iexplore.exe
GET
200
142.250.186.142:80
http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl
US
binary
12.8 Kb
whitelisted
2240
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
binary
1.47 Kb
whitelisted
1788
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
2240
iexplore.exe
GET
200
142.250.186.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDaQqCWnITUZwrTnGlh64Go
US
binary
472 b
whitelisted
2240
iexplore.exe
GET
200
104.18.15.101:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
whitelisted
2240
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?834acb3c09b67281
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
820
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3660
SamsungFrp2020.exe
172.67.188.109:443
code.eftp-server.com
CLOUDFLARENET
US
suspicious
2240
iexplore.exe
142.250.185.164:443
www.google.com
GOOGLE
US
whitelisted
1788
iexplore.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
malicious
2240
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2240
iexplore.exe
142.250.186.99:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2240
iexplore.exe
104.21.26.229:443
easy-firmware.com
CLOUDFLARENET
—
suspicious
2240
iexplore.exe
142.250.186.142:80
crls.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
code.eftp-server.com
  • 172.67.188.109
  • 104.21.8.107
unknown
www.google.com
  • 142.250.185.164
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.186.99
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.187
  • 23.53.42.202
  • 23.53.42.106
  • 23.53.42.176
  • 23.53.42.104
  • 23.53.42.154
  • 23.53.42.163
whitelisted
crls.pki.goog
  • 142.250.186.142
whitelisted
easy-firmware.com
  • 104.21.26.229
  • 172.67.139.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.googletagmanager.com
  • 142.250.186.40
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SamsungFrp2020.exe