File name:

Smadav Pro 2021 14.6.2.kuyhAa.7z

Full analysis: https://app.any.run/tasks/baf2e768-2600-4ef9-8f7f-01737f14310b
Verdict: Malicious activity
Analysis date: November 18, 2023, 14:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

685C560E136BC4E4BC3009160908BF69

SHA1:

E6EB063566D0D0EE4D537D76D36E0B8F75D2E0BD

SHA256:

92A9ACFF5303029E36BFBCDE2A900E399E44EED98122C1F14FC519D38511B3A3

SSDEEP:

98304:xH57h2zbEsLQ0rd5Mv+0hk2QNLRgPYHx2Cl9E31V5gKx+QYby+F0IWgvO/whs7lN:qU+SVKTQ7MS0Z2+Wz3X7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)

    • Registers / Runs the DLL via REGSVR32.EXE

      • smadav2021rev1462.tmp (PID: 3812)

    • Uses Task Scheduler to run other applications

      • SMΔRTP.exe (PID: 3740)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • smadav2021rev1462.tmp (PID: 3812)

    • Process drops legitimate windows executable

      • smadav2021rev1462.tmp (PID: 3812)

    • The process verifies whether the antivirus software is installed

      • smadav2021rev1462.tmp (PID: 3812)
      • schtasks.exe (PID: 2196)
      • SmadavProtect32.exe (PID: 2380)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads the Internet Settings

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Uses TASKKILL.EXE to kill process

      • smadav2021rev1462.tmp (PID: 3812)

    • Searches for installed software

      • smadav2021rev1462.tmp (PID: 3812)

    • Application launched itself

      • SMΔRTP.exe (PID: 3740)

    • Checks Windows Trust Settings

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads settings of System Certificates

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads security settings of Internet Explorer

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Adds/modifies Windows certificates

      • smadav2021rev1462.tmp (PID: 3812)

    • Process changes security settings for the VBA macro

      • SMΔRTP.exe (PID: 1608)

    • Reads Microsoft Outlook installation path

      • SMΔRTP.exe (PID: 1608)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SmadavProtect32.exe (PID: 2380)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3484)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3384)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Create files in a temporary directory

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 1608)
      • SMΔRTP.exe (PID: 3740)

    • Manual execution by a user

      • smadav2021rev1462.exe (PID: 3276)
      • notepad.exe (PID: 3760)
      • wmpnscfg.exe (PID: 2088)
      • regedit.exe (PID: 2184)
      • regedit.exe (PID: 2544)

    • Creates files in the program directory

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Creates files or folders in the user directory

      • SMΔRTP.exe (PID: 3740)

    • Checks proxy server information

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
19
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs smadav2021rev1462.exe no specs smadav2021rev1462.tmp no specs smadav2021rev1462.exe smadav2021rev1462.tmp no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs notepad.exe no specs regsvr32.exe no specs smδrtp.exe schtasks.exe no specs smadavprotect32.exe no specs smδrtp.exe wmpnscfg.exe no specs regedit.exe no specs regedit.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1608"C:\Program Files\Smadav\SMΔRTP.exe" C:\Program Files\SMADAV\SMΔRTP.exe
SMΔRTP.exe
User:
admin
Company:
Smadsoft
Integrity Level:
HIGH
Description:
Smadav USB Antivirus & Additional Protection
Exit code:
0
Version:
4.146.0002
Modules
Images
c:\program files\smadav\smδrtp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064"C:\Windows\System32\taskkill.exe" /f /im SmadavProtect32.exeC:\Windows\System32\taskkill.exe—smadav2021rev1462.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2184"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
2196"C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\admin\AppData\Roaming\Smadav\smadav.xml"C:\Windows\System32\schtasks.exe—SMΔRTP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2380"C:\Program Files\Smadav\SmadavProtect32.exe" C:\Program Files\SMADAV\SmadavProtect32.exe—SMΔRTP.exe
User:
admin
Company:
Smadav Software
Integrity Level:
HIGH
Description:
Smadav Whitelisting Protection
Exit code:
0
Version:
1, 0, 0, 3
Modules
Images
c:\program files\smadav\smadavprotect32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2544"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3276"C:\Users\admin\Desktop\smadav2021rev1462.exe" C:\Users\admin\Desktop\smadav2021rev1462.exe—explorer.exe
User:
admin
Company:
Smadsoft
Integrity Level:
MEDIUM
Description:
SMADAV Setup
Exit code:
0
Version:
14.6.2.0
Modules
Images
c:\users\admin\desktop\smadav2021rev1462.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3384"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Smadav Pro 2021 14.6.2.kuyhAa.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 929
Read events
15 799
Write events
120
Delete events
10

Modification events

(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}\{857FCC3A-0AC8-40AF-9F8C-F9A324CC6E41}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7B3D071F-D581-4596-84AB-25C6800DF61B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3484) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
25
Suspicious files
9
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484WinRAR.exeC:\Users\admin\Desktop\Serial\keygen.7zcompressed
MD5:67E96E9BCF3E74757568E57C2A1D047E
SHA256:63AFA814A7DD33D15F05A39B1BC6CD8A9AAE85BC049F5023D9F9C53529188B73
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\Readme.txttext
MD5:55E785821BCD00872AAB340CB7011064
SHA256:C1E3B31577461005CB5DF0129D6E993477D103EEB843E12C93900007D1D72717
3484WinRAR.exeC:\Users\admin\Desktop\Read Me.txttext
MD5:A39DBB3E51C65C0E67A5742BE556FB8A
SHA256:72C43D58974A0A02C41A1038A95F0C151838126DCB2AE8969528AA38810D6606
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\SMΔRTP.exeexecutable
MD5:F3848AC6A985488A981EFA12E6568E09
SHA256:B7BDD99CD0BEF80600BF02A0FEC60B4BEAC317D69C4755319604413A255FFA71
3836smadav2021rev1462.exeC:\Users\admin\AppData\Local\Temp\is-ITT8E.tmp\smadav2021rev1462.tmpexecutable
MD5:8976FCBFC98FA88FC2033C3F4E8BDC9A
SHA256:ACA42D3162B07B10F367C723833D19901F415AFCA6326DB49AF71520E97FC334
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-B94T1.tmpexecutable
MD5:793360AAE83C88988558B0A98121FDE8
SHA256:37155E5E61AD5D74EDF2D6AF3F468CD6D27627C58558E0EE8740A5192F5160FE
3484WinRAR.exeC:\Users\admin\Desktop\www.kuyhAa.Me.urltext
MD5:30BABA57CBAA11C62BCC649938F40566
SHA256:6C53BB74704746D3C5C20527A39656F0D321DE3F99DEDE0C3724362C7E01E253
3812smadav2021rev1462.tmpC:\Users\admin\AppData\Local\Temp\is-0OU3K.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\unins000.exeexecutable
MD5:793360AAE83C88988558B0A98121FDE8
SHA256:37155E5E61AD5D74EDF2D6AF3F468CD6D27627C58558E0EE8740A5192F5160FE
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-J9UMB.tmpexecutable
MD5:F3848AC6A985488A981EFA12E6568E09
SHA256:B7BDD99CD0BEF80600BF02A0FEC60B4BEAC317D69C4755319604413A255FFA71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://lempar.com/smadstat.php?mac=1994429369A727963&key=0&name=0&os=2%2E6%2E1%2E7601&build=1263&old=-1&mode=0&stat1=777&stat2=1&stat3=0&stat4=3&stat5=8002&stat6=6
unknown
binary
1 b
—
3740
SMΔRTP.exe
GET
301
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt
unknown
html
255 b
—
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt/
unknown
text
396 b
—
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
—
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.smadav.org/updates.txt
unknown
text
565 b
—
3740
SMΔRTP.exe
POST
200
51.222.109.195:80
http://mencapai.com/smadavstats80.php
unknown
text
3 b
—
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
—
1608
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavscanstats.php
unknown
text
2 b
—
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats27.php
unknown
text
3 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
3740
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown
3740
SMΔRTP.exe
51.222.109.195:80
mencapai.com
OVH SAS
CA
unknown
1608
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown

DNS requests

Domain
IP
Reputation
lempar.com
  • 144.217.252.68
unknown
dwres.com
  • 144.217.252.68
unknown
www.lempar.com
  • 144.217.252.68
unknown
www.smadav.org
  • 144.217.252.68
unknown
mencapai.com
  • 51.222.109.195
unknown
dns.msftncsi.com
  • 131.107.255.255
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Smadav Pro 2021 14.6.2.kuyhAa.7z