File name:

Smadav Pro 2021 14.6.2.kuyhAa.7z

Full analysis: https://app.any.run/tasks/baf2e768-2600-4ef9-8f7f-01737f14310b
Verdict: Malicious activity
Analysis date: November 18, 2023, 14:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

685C560E136BC4E4BC3009160908BF69

SHA1:

E6EB063566D0D0EE4D537D76D36E0B8F75D2E0BD

SHA256:

92A9ACFF5303029E36BFBCDE2A900E399E44EED98122C1F14FC519D38511B3A3

SSDEEP:

98304:xH57h2zbEsLQ0rd5Mv+0hk2QNLRgPYHx2Cl9E31V5gKx+QYby+F0IWgvO/whs7lN:qU+SVKTQ7MS0Z2+Wz3X7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • smadav2021rev1462.exe (PID: 3276)

    • Registers / Runs the DLL via REGSVR32.EXE

      • smadav2021rev1462.tmp (PID: 3812)

    • Uses Task Scheduler to run other applications

      • SMΔRTP.exe (PID: 3740)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • smadav2021rev1462.tmp (PID: 3812)

    • Reads the Internet Settings

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Uses TASKKILL.EXE to kill process

      • smadav2021rev1462.tmp (PID: 3812)

    • The process verifies whether the antivirus software is installed

      • smadav2021rev1462.tmp (PID: 3812)
      • SmadavProtect32.exe (PID: 2380)
      • schtasks.exe (PID: 2196)
      • SMΔRTP.exe (PID: 1608)
      • SMΔRTP.exe (PID: 3740)

    • Searches for installed software

      • smadav2021rev1462.tmp (PID: 3812)

    • Application launched itself

      • SMΔRTP.exe (PID: 3740)

    • Checks Windows Trust Settings

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads security settings of Internet Explorer

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Adds/modifies Windows certificates

      • smadav2021rev1462.tmp (PID: 3812)

    • Reads settings of System Certificates

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Process changes security settings for the VBA macro

      • SMΔRTP.exe (PID: 1608)

    • Reads Microsoft Outlook installation path

      • SMΔRTP.exe (PID: 1608)

    • Reads the Windows owner or organization settings

      • smadav2021rev1462.tmp (PID: 3812)

  • INFO

    • Create files in a temporary directory

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 1608)
      • SMΔRTP.exe (PID: 3740)
      • smadav2021rev1462.exe (PID: 3836)

    • Manual execution by a user

      • smadav2021rev1462.exe (PID: 3276)
      • notepad.exe (PID: 3760)
      • wmpnscfg.exe (PID: 2088)
      • regedit.exe (PID: 2184)
      • regedit.exe (PID: 2544)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3384)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SmadavProtect32.exe (PID: 2380)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)
      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)

    • Reads the computer name

      • smadav2021rev1462.tmp (PID: 3812)
      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3484)

    • Creates files in the program directory

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Creates files or folders in the user directory

      • SMΔRTP.exe (PID: 3740)

    • Checks proxy server information

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
19
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs smadav2021rev1462.exe no specs smadav2021rev1462.tmp no specs smadav2021rev1462.exe smadav2021rev1462.tmp no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs notepad.exe no specs regsvr32.exe no specs smδrtp.exe schtasks.exe no specs smadavprotect32.exe no specs smδrtp.exe wmpnscfg.exe no specs regedit.exe no specs regedit.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1608"C:\Program Files\Smadav\SMΔRTP.exe" C:\Program Files\SMADAV\SMΔRTP.exe
SMΔRTP.exe
User:
admin
Company:
Smadsoft
Integrity Level:
HIGH
Description:
Smadav USB Antivirus & Additional Protection
Exit code:
0
Version:
4.146.0002
Modules
Images
c:\program files\smadav\smδrtp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064"C:\Windows\System32\taskkill.exe" /f /im SmadavProtect32.exeC:\Windows\System32\taskkill.exe—smadav2021rev1462.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2184"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
2196"C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\admin\AppData\Roaming\Smadav\smadav.xml"C:\Windows\System32\schtasks.exe—SMΔRTP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2380"C:\Program Files\Smadav\SmadavProtect32.exe" C:\Program Files\SMADAV\SmadavProtect32.exe—SMΔRTP.exe
User:
admin
Company:
Smadav Software
Integrity Level:
HIGH
Description:
Smadav Whitelisting Protection
Exit code:
0
Version:
1, 0, 0, 3
Modules
Images
c:\program files\smadav\smadavprotect32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2544"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3276"C:\Users\admin\Desktop\smadav2021rev1462.exe" C:\Users\admin\Desktop\smadav2021rev1462.exe—explorer.exe
User:
admin
Company:
Smadsoft
Integrity Level:
MEDIUM
Description:
SMADAV Setup
Exit code:
0
Version:
14.6.2.0
Modules
Images
c:\users\admin\desktop\smadav2021rev1462.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3384"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Smadav Pro 2021 14.6.2.kuyhAa.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 929
Read events
15 799
Write events
120
Delete events
10

Modification events

(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}\{857FCC3A-0AC8-40AF-9F8C-F9A324CC6E41}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7B3D071F-D581-4596-84AB-25C6800DF61B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3484) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
25
Suspicious files
9
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484WinRAR.exeC:\Users\admin\Desktop\smadav2021rev1462.exeexecutable
MD5:FB9FFAC6931CAEFD9C1D21605CC1F45F
SHA256:FC7D7A31BAC353179812F41A2DC4B45BFAE189AC547F175D7E992079FCE415A2
3484WinRAR.exeC:\Users\admin\Desktop\Serial\keygen.7zcompressed
MD5:67E96E9BCF3E74757568E57C2A1D047E
SHA256:63AFA814A7DD33D15F05A39B1BC6CD8A9AAE85BC049F5023D9F9C53529188B73
3484WinRAR.exeC:\Users\admin\Desktop\Read Me.txttext
MD5:A39DBB3E51C65C0E67A5742BE556FB8A
SHA256:72C43D58974A0A02C41A1038A95F0C151838126DCB2AE8969528AA38810D6606
3484WinRAR.exeC:\Users\admin\Desktop\Serial\key.txttext
MD5:69C80A07D100EA5562B4D67DD5C601A2
SHA256:544530DC169E5F4915DF8BD586D76243754B34ADA7EBE203AF6F54E247845862
3812smadav2021rev1462.tmpC:\Users\admin\AppData\Local\Temp\is-0OU3K.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
3276smadav2021rev1462.exeC:\Users\admin\AppData\Local\Temp\is-2T5KD.tmp\smadav2021rev1462.tmpexecutable
MD5:8976FCBFC98FA88FC2033C3F4E8BDC9A
SHA256:ACA42D3162B07B10F367C723833D19901F415AFCA6326DB49AF71520E97FC334
3484WinRAR.exeC:\Users\admin\Desktop\Serial\reg.regtext
MD5:8B10F9BF6F91774B493FC1AC1DB9E4F7
SHA256:99E9125980ED61BE77F78B1F376527D12F74C388AF00844E651CE2CD5336971D
3484WinRAR.exeC:\Users\admin\Desktop\www.kuyhAa.Me.urltext
MD5:30BABA57CBAA11C62BCC649938F40566
SHA256:6C53BB74704746D3C5C20527A39656F0D321DE3F99DEDE0C3724362C7E01E253
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\SMΔRTP.exeexecutable
MD5:F3848AC6A985488A981EFA12E6568E09
SHA256:B7BDD99CD0BEF80600BF02A0FEC60B4BEAC317D69C4755319604413A255FFA71
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-J9UMB.tmpexecutable
MD5:F3848AC6A985488A981EFA12E6568E09
SHA256:B7BDD99CD0BEF80600BF02A0FEC60B4BEAC317D69C4755319604413A255FFA71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt/
unknown
text
396 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.smadav.org/updates.txt
unknown
text
565 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats27.php
unknown
text
3 b
unknown
1608
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavscanstats.php
unknown
text
2 b
unknown
3740
SMΔRTP.exe
GET
301
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt
unknown
html
255 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://lempar.com/smadstat.php?mac=1994429369A727963&key=0&name=0&os=2%2E6%2E1%2E7601&build=1263&old=-1&mode=0&stat1=777&stat2=1&stat3=0&stat4=3&stat5=8002&stat6=6
unknown
binary
1 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
unknown
3740
SMΔRTP.exe
POST
200
51.222.109.195:80
http://mencapai.com/smadavstats80.php
unknown
text
3 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3740
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown
3740
SMΔRTP.exe
51.222.109.195:80
mencapai.com
OVH SAS
CA
unknown
1608
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown

DNS requests

Domain
IP
Reputation
lempar.com
  • 144.217.252.68
unknown
dwres.com
  • 144.217.252.68
unknown
www.lempar.com
  • 144.217.252.68
unknown
www.smadav.org
  • 144.217.252.68
unknown
mencapai.com
  • 51.222.109.195
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Smadav Pro 2021 14.6.2.kuyhAa.7z