File name:

Smadav Pro 2021 14.6.2.kuyhAa.7z

Full analysis: https://app.any.run/tasks/baf2e768-2600-4ef9-8f7f-01737f14310b
Verdict: Malicious activity
Analysis date: November 18, 2023, 14:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

685C560E136BC4E4BC3009160908BF69

SHA1:

E6EB063566D0D0EE4D537D76D36E0B8F75D2E0BD

SHA256:

92A9ACFF5303029E36BFBCDE2A900E399E44EED98122C1F14FC519D38511B3A3

SSDEEP:

98304:xH57h2zbEsLQ0rd5Mv+0hk2QNLRgPYHx2Cl9E31V5gKx+QYby+F0IWgvO/whs7lN:qU+SVKTQ7MS0Z2+Wz3X7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)

    • Registers / Runs the DLL via REGSVR32.EXE

      • smadav2021rev1462.tmp (PID: 3812)

    • Uses Task Scheduler to run other applications

      • SMΔRTP.exe (PID: 3740)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • smadav2021rev1462.tmp (PID: 3812)

    • Uses TASKKILL.EXE to kill process

      • smadav2021rev1462.tmp (PID: 3812)

    • Reads the Internet Settings

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Searches for installed software

      • smadav2021rev1462.tmp (PID: 3812)

    • Process drops legitimate windows executable

      • smadav2021rev1462.tmp (PID: 3812)

    • The process verifies whether the antivirus software is installed

      • smadav2021rev1462.tmp (PID: 3812)
      • SmadavProtect32.exe (PID: 2380)
      • schtasks.exe (PID: 2196)
      • SMΔRTP.exe (PID: 1608)
      • SMΔRTP.exe (PID: 3740)

    • Adds/modifies Windows certificates

      • smadav2021rev1462.tmp (PID: 3812)

    • Checks Windows Trust Settings

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Application launched itself

      • SMΔRTP.exe (PID: 3740)

    • Reads security settings of Internet Explorer

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Reads settings of System Certificates

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Process changes security settings for the VBA macro

      • SMΔRTP.exe (PID: 1608)

    • Reads Microsoft Outlook installation path

      • SMΔRTP.exe (PID: 1608)

  • INFO

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3384)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.tmp (PID: 3624)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)
      • SmadavProtect32.exe (PID: 2380)
      • wmpnscfg.exe (PID: 2088)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3384)
      • smadav2021rev1462.tmp (PID: 3624)
      • SMΔRTP.exe (PID: 3740)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 1608)
      • wmpnscfg.exe (PID: 2088)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3484)

    • Create files in a temporary directory

      • smadav2021rev1462.exe (PID: 3276)
      • smadav2021rev1462.exe (PID: 3836)
      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 1608)
      • SMΔRTP.exe (PID: 3740)

    • Manual execution by a user

      • smadav2021rev1462.exe (PID: 3276)
      • notepad.exe (PID: 3760)
      • wmpnscfg.exe (PID: 2088)
      • regedit.exe (PID: 2184)
      • regedit.exe (PID: 2544)

    • Creates files in the program directory

      • smadav2021rev1462.tmp (PID: 3812)
      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Checks proxy server information

      • SMΔRTP.exe (PID: 3740)
      • SMΔRTP.exe (PID: 1608)

    • Creates files or folders in the user directory

      • SMΔRTP.exe (PID: 3740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
19
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs smadav2021rev1462.exe no specs smadav2021rev1462.tmp no specs smadav2021rev1462.exe smadav2021rev1462.tmp no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs notepad.exe no specs regsvr32.exe no specs smδrtp.exe schtasks.exe no specs smadavprotect32.exe no specs smδrtp.exe wmpnscfg.exe no specs regedit.exe no specs regedit.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1608"C:\Program Files\Smadav\SMΔRTP.exe" C:\Program Files\SMADAV\SMΔRTP.exe
SMΔRTP.exe
User:
admin
Company:
Smadsoft
Integrity Level:
HIGH
Description:
Smadav USB Antivirus & Additional Protection
Exit code:
0
Version:
4.146.0002
Modules
Images
c:\program files\smadav\smδrtp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064"C:\Windows\System32\taskkill.exe" /f /im SmadavProtect32.exeC:\Windows\System32\taskkill.exe—smadav2021rev1462.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2184"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
2196"C:\Windows\system32\schtasks.exe" /create /tn "smadav" /xml "C:\Users\admin\AppData\Roaming\Smadav\smadav.xml"C:\Windows\System32\schtasks.exe—SMΔRTP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2380"C:\Program Files\Smadav\SmadavProtect32.exe" C:\Program Files\SMADAV\SmadavProtect32.exe—SMΔRTP.exe
User:
admin
Company:
Smadav Software
Integrity Level:
HIGH
Description:
Smadav Whitelisting Protection
Exit code:
0
Version:
1, 0, 0, 3
Modules
Images
c:\program files\smadav\smadavprotect32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2544"regedit.exe" "C:\Users\admin\Desktop\Serial\reg.reg"C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3276"C:\Users\admin\Desktop\smadav2021rev1462.exe" C:\Users\admin\Desktop\smadav2021rev1462.exe—explorer.exe
User:
admin
Company:
Smadsoft
Integrity Level:
MEDIUM
Description:
SMADAV Setup
Exit code:
0
Version:
14.6.2.0
Modules
Images
c:\users\admin\desktop\smadav2021rev1462.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3384"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Smadav Pro 2021 14.6.2.kuyhAa.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
15 929
Read events
15 799
Write events
120
Delete events
10

Modification events

(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}\{857FCC3A-0AC8-40AF-9F8C-F9A324CC6E41}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{625C560B-4EDB-4436-A745-86833C13693C}
Operation:delete keyName:(default)
Value:
(PID) Process:(3384) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{7B3D071F-D581-4596-84AB-25C6800DF61B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3484) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3484) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
25
Suspicious files
9
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3484WinRAR.exeC:\Users\admin\Desktop\Read Me.txttext
MD5:A39DBB3E51C65C0E67A5742BE556FB8A
SHA256:72C43D58974A0A02C41A1038A95F0C151838126DCB2AE8969528AA38810D6606
3484WinRAR.exeC:\Users\admin\Desktop\Serial\keygen.7zcompressed
MD5:67E96E9BCF3E74757568E57C2A1D047E
SHA256:63AFA814A7DD33D15F05A39B1BC6CD8A9AAE85BC049F5023D9F9C53529188B73
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\Smadav.loovbinary
MD5:2A767A5122C621A4A55D6DC758F5C0BA
SHA256:9B16AC3BEA5D40FEDFF49BA13EC1992A960C7F615543DBD7372D90705E0A224A
3276smadav2021rev1462.exeC:\Users\admin\AppData\Local\Temp\is-2T5KD.tmp\smadav2021rev1462.tmpexecutable
MD5:8976FCBFC98FA88FC2033C3F4E8BDC9A
SHA256:ACA42D3162B07B10F367C723833D19901F415AFCA6326DB49AF71520E97FC334
3484WinRAR.exeC:\Users\admin\Desktop\kuyhAa.Me.urltext
MD5:B6F5CE7267C50CF195B1AE2A8EAEC913
SHA256:ED77A3BC71138AB5CCD49ABA225514AC860B7251EE16DB3A2B91FD4719F9D291
3484WinRAR.exeC:\Users\admin\Desktop\Serial\reg.regtext
MD5:8B10F9BF6F91774B493FC1AC1DB9E4F7
SHA256:99E9125980ED61BE77F78B1F376527D12F74C388AF00844E651CE2CD5336971D
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\Readme.txttext
MD5:55E785821BCD00872AAB340CB7011064
SHA256:C1E3B31577461005CB5DF0129D6E993477D103EEB843E12C93900007D1D72717
3484WinRAR.exeC:\Users\admin\Desktop\www.kuyhAa.Me.urltext
MD5:30BABA57CBAA11C62BCC649938F40566
SHA256:6C53BB74704746D3C5C20527A39656F0D321DE3F99DEDE0C3724362C7E01E253
3484WinRAR.exeC:\Users\admin\Desktop\smadav2021rev1462.exeexecutable
MD5:FB9FFAC6931CAEFD9C1D21605CC1F45F
SHA256:FC7D7A31BAC353179812F41A2DC4B45BFAE189AC547F175D7E992079FCE415A2
3812smadav2021rev1462.tmpC:\Program Files\SMADAV\is-7N4GC.tmptext
MD5:55E785821BCD00872AAB340CB7011064
SHA256:C1E3B31577461005CB5DF0129D6E993477D103EEB843E12C93900007D1D72717
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://lempar.com/smadstat.php?mac=1994429369A727963&key=0&name=0&os=2%2E6%2E1%2E7601&build=1263&old=-1&mode=0&stat1=777&stat2=1&stat3=0&stat4=3&stat5=8002&stat6=6
unknown
binary
1 b
unknown
1608
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavscanstats.php
unknown
text
2 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt/
unknown
text
396 b
unknown
3740
SMΔRTP.exe
GET
200
144.217.252.68:80
http://www.smadav.org/updates.txt
unknown
text
565 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
unknown
3740
SMΔRTP.exe
POST
200
51.222.109.195:80
http://mencapai.com/smadavstats80.php
unknown
text
3 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats15.php
unknown
text
3 b
unknown
3740
SMΔRTP.exe
GET
301
144.217.252.68:80
http://www.lempar.com/update/secure-smadav.txt
unknown
html
255 b
unknown
3740
SMΔRTP.exe
POST
200
144.217.252.68:80
http://dwres.com/smadavstats27.php
unknown
text
3 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3740
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown
3740
SMΔRTP.exe
51.222.109.195:80
mencapai.com
OVH SAS
CA
unknown
1608
SMΔRTP.exe
144.217.252.68:80
lempar.com
OVH SAS
CA
unknown

DNS requests

Domain
IP
Reputation
lempar.com
  • 144.217.252.68
malicious
dwres.com
  • 144.217.252.68
unknown
www.lempar.com
  • 144.217.252.68
malicious
www.smadav.org
  • 144.217.252.68
unknown
mencapai.com
  • 51.222.109.195
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Smadav Pro 2021 14.6.2.kuyhAa.7z