File name:

Smadav Pro 2021 14.6.2.kuyhAa.7z

Full analysis: https://app.any.run/tasks/baf2e768-2600-4ef9-8f7f-01737f14310b
Verdict: Malicious activity
Analysis date: November 18, 2023, 14:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

685C560E136BC4E4BC3009160908BF69

SHA1:

E6EB063566D0D0EE4D537D76D36E0B8F75D2E0BD

SHA256:

92A9ACFF5303029E36BFBCDE2A900E399E44EED98122C1F14FC519D38511B3A3

SSDEEP:

98304:xH57h2zbEsLQ0rd5Mv+0hk2QNLRgPYHx2Cl9E31V5gKx+QYby+F0IWgvO/whs7lN:qU+SVKTQ7MS0Z2+Wz3X7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)

    • Registers / Runs the DLL via REGSVR32.EXE

      • smadav2021rev1462.tmp (PID: 3812)

    • Uses Task Scheduler to run other applications

      • SMΔRTP.exe (PID: 3740)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • smadav2021rev1462.tmp (PID: 3812)

    • Process drops legitimate windows executable

      • smadav2021rev1462.tmp (PID: 3812)

    • The process verifies whether the antivirus software is installed

      • smadav2021rev1462.tmp (PID: 3812)
      • SmadavProtect32.exe (PID: 2380)
      • schtasks.exe (PID: 2196)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads the Internet Settings

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Uses TASKKILL.EXE to kill process

      • smadav2021rev1462.tmp (PID: 3812)

    • Searches for installed software

      • smadav2021rev1462.tmp (PID: 3812)

    • Application launched itself

      • SMΔRTP.exe (PID: 3740)

    • Checks Windows Trust Settings

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads security settings of Internet Explorer

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads settings of System Certificates

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Adds/modifies Windows certificates

      • smadav2021rev1462.tmp (PID: 3812)

    • Process changes security settings for the VBA macro

      • SMΔRTP.exe (PID: 1608)

    • Reads Microsoft Outlook installation path

      • SMΔRTP.exe (PID: 1608)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SmadavProtect32.exe (PID: 2380)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Create files in a temporary directory

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3384)
      • SMΔRTP.exe (PID: 3740)
      • wmpnscfg.exe (PID: 2088)
      • SMΔRTP.exe (PID: 1608)

    • Manual execution by a user

      • smadav2021rev1462.exe (PID: 3276)
      • notepad.exe (PID: 3760)
      • wmpnscfg.exe (PID: 2088)
      • regedit.exe (PID: 2184)
      • regedit.exe (PID: 2544)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3484)

    • Creates files in the program directory

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Creates files or folders in the user directory

      • SMΔRTP.exe (PID: 3740)

    • Checks proxy server information

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
19
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs smadav2021rev1462.exe no specs smadav2021rev1462.tmp no specs smadav2021rev1462.exe smadav2021rev1462.tmp no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs notepad.exe no specs regsvr32.exe no specs smδrtp.exe schtasks.exe no specs smadavprotect32.exe no specs smδrtp.exe wmpnscfg.exe no specs regedit.exe no specs regedit.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1608"C:\Program Files\Smadav\SMΔRTP.exe" C:\Program Files\SMADAV\SMΔRTP.exe
SMΔRTP.exe
User:
admin
Company:
Smadsoft
Integrity Level:
HIGH
Description:
Smadav USB Antivirus & Additional Protection
Exit code:
0
Version:
4.146.0002
Modules
Images
c:\program files\smadav\smδrtp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064"C:\Windows\System32\taskkill.exe" /f /im SmadavProtect32.exeC:\Windows\System32\taskkill.exe—smadav2021rev1462.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2184"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
2196"C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\admin\AppData\Roaming\Smadav\smadav.xml"C:\Windows\System32\schtasks.exe—SMΔRTP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2380"C:\Program Files\Smadav\SmadavProtect32.exe" C:\Program Files\SMADAV\SmadavProtect32.exe—SMΔRTP.exe
User:
admin
Company:
Smadav Software
Integrity Level:
HIGH
Description:
Smadav Whitelisting Protection
Exit code:
0
Version:
1, 0, 0, 3
Modules
Images
c:\program files\smadav\smadavprotect32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2544"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3276"C:\Users\admin\Desktop\smadav2021rev1462.exe" C:\Users\admin\Desktop\smadav2021rev1462.exe—explorer.exe
User:
admin
Company:
Smadsoft
Integrity Level:
MEDIUM
Description:
SMADAV Setup
Exit code:
0
Version:
14.6.2.0
Modules
Images
c:\users\admin\desktop\smadav2021rev1462.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3384"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Smadav Pro 2021 14.6.2.kuyhAa.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 929
Read events
15 799
Write events
120
Delete events
10

Modification events

(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}\{857FCC3A-0AC8-40AF-9F8C-F9A324CC6E41}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7B3D071F-D581-4596-84AB-25C6800DF61B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3484) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
25
Suspicious files
9
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484WinRAR.exeC:\Users\admin\Desktop\Serial\key.txttext
MD5:69C80A07D100EA5562B4D67DD5C601A2
SHA256:544530DC169E5F4915DF8BD586D76243754B34ADA7EBE203AF6F54E247845862
3484WinRAR.exeC:\Users\admin\Desktop\kuyhAa.Me.urltext
MD5:B6F5CE7267C50CF195B1AE2A8EAEC913
SHA256:ED77A3BC71138AB5CCD49ABA225514AC860B7251EE16DB3A2B91FD4719F9D291
3484WinRAR.exeC:\Users\admin\Desktop\smadav2021rev1462.exeexecutable
MD5:FB9FFAC6931CAEFD9C1D21605CC1F45F
SHA256:FC7D7A31BAC353179812F41A2DC4B45BFAE189AC547F175D7E992079FCE415A2
3276smadav2021rev1462.exeC:\Users\admin\AppData\Local\Temp\is-2T5KD.tmp\smadav2021rev1462.tmpexecutable
MD5:8976FCBFC98FA88FC2033C3F4E8BDC9A
SHA256:ACA42D3162B07B10F367C723833D19901F415AFCA6326DB49AF71520E97FC334
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\unins000.exeexecutable
MD5:793360AAE83C88988558B0A98121FDE8
SHA256:37155E5E61AD5D74EDF2D6AF3F468CD6D27627C58558E0EE8740A5192F5160FE
3484WinRAR.exeC:\Users\admin\Desktop\www.kuyhAa.Me.urltext
MD5:30BABA57CBAA11C62BCC649938F40566
SHA256:6C53BB74704746D3C5C20527A39656F0D321DE3F99DEDE0C3724362C7E01E253
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-B94T1.tmpexecutable
MD5:793360AAE83C88988558B0A98121FDE8
SHA256:37155E5E61AD5D74EDF2D6AF3F468CD6D27627C58558E0EE8740A5192F5160FE
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-7N4GC.tmptext
MD5:55E785821BCD00872AAB340CB7011064
SHA256:C1E3B31577461005CB5DF0129D6E993477D103EEB843E12C93900007D1D72717
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-J9UMB.tmpexecutable
MD5:F3848AC6A985488A981EFA12E6568E09
SHA256:B7BDD99CD0BEF80600BF02A0FEC60B4BEAC317D69C4755319604413A255FFA71
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\Readme.txttext
MD5:55E785821BCD00872AAB340CB7011064
SHA256:C1E3B31577461005CB5DF0129D6E993477D103EEB843E12C93900007D1D72717
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://lempar.com/smadstat.php?mac=1994429369A727963&key=0&name=0&os=2%2E6%2E1%2E7601&build=1263&old=-1&mode=0&stat1=777&stat2=1&stat3=0&stat4=3&stat5=8002&stat6=6
CA
binary
1 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt/
CA
text
396 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats27.php
CA
text
3 b
unknown
3740
SMΔRTP.exe
GET
301
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt
CA
html
255 b
unknown
3740
SMΔRTP.exe
POST
200
51.222.109.195:80
http://mencapai.com/smadavstats80.php
CA
text
3 b
unknown
1608
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavscanstats.php
CA
text
2 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
CA
text
3 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
CA
text
3 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.smadav.org/updates.txt
CA
text
565 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3740
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown
3740
SMΔRTP.exe
51.222.109.195:80
mencapai.com
OVH SAS
CA
unknown
1608
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown

DNS requests

Domain
IP
Reputation
lempar.com
  • 144.217.252.68
malicious
dwres.com
  • 144.217.252.68
unknown
www.lempar.com
  • 144.217.252.68
malicious
www.smadav.org
  • 144.217.252.68
unknown
mencapai.com
  • 51.222.109.195
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Smadav Pro 2021 14.6.2.kuyhAa.7z