analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

sm.rar

Full analysis: https://app.any.run/tasks/e4861087-11c7-4e16-bf06-534ece9d31cc
Verdict: Malicious activity
Analysis date: April 01, 2023, 00:20:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: RecoveryRecordPresent
MD5:

546331BD7A1ABD37750A4A3F5C226379

SHA1:

1B6A2DA471AE52EB08F1D69EBE38D3E100887D7A

SHA256:

B266F235794AF5D05EBBD0A327EF1590A832EF8057A8D657744602842A48A856

SSDEEP:

24576:xrjyM2jvyFjn/qWLKau3jz+kdVQIGwr6ZqBLpY1yaw8Swb2J1hGizqZCp5zKh19l:xreMwveCWLKaaeAVQIGwnpY1yo/qhG8U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sm.exe (PID: 3808)
      • crack.exe (PID: 1964)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Create files in the Startup directory

      • crack.exe (PID: 1964)

  • SUSPICIOUS

    • Reads the Internet Settings

      • sm.exe (PID: 3808)

    • Reads Microsoft Outlook installation path

      • sm.exe (PID: 3808)

    • Executable content was dropped or overwritten

      • crack.exe (PID: 1964)
      • sm.exe (PID: 3808)

    • Reads Internet Explorer settings

      • sm.exe (PID: 3808)

  • INFO

    • Reads the computer name

      • sm.exe (PID: 3808)
      • crack.exe (PID: 1964)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Checks supported languages

      • sm.exe (PID: 3808)
      • crack.exe (PID: 1964)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Checks proxy server information

      • sm.exe (PID: 3808)

    • The process checks LSA protection

      • sm.exe (PID: 3808)
      • crack.exe (PID: 1964)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Manual execution by a user

      • sm.exe (PID: 3808)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2512)

    • Reads the machine GUID from the registry

      • sm.exe (PID: 3808)
      • crack.exe (PID: 1964)
      • crack.exe (PID: 3100)
      • crack.exe (PID: 3540)

    • Creates files or folders in the user directory

      • crack.exe (PID: 1964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: sm\sm.exe
PackingMethod: Normal
ModifyDate: 2022:12:04 21:35:48
OperatingSystem: Win32
UncompressedSize: 1468606
CompressedSize: 1331088
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe sm.exe crack.exe crack.exe no specs crack.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2512"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\sm.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ntdll.dll
3808"C:\Users\admin\Desktop\sm\sm.exe" C:\Users\admin\Desktop\sm\sm.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sm\sm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
1964"C:\Users\admin\Desktop\sm\crack.exe" C:\Users\admin\Desktop\sm\crack.exe
sm.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\sm\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3100"C:\Users\admin\Desktop\sm\crack.exe" C:\Users\admin\Desktop\sm\crack.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sm\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3540"C:\Users\admin\Desktop\sm\crack.exe" C:\Users\admin\Desktop\sm\crack.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\sm\crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
3 202
Read events
3 144
Write events
58
Delete events
0

Modification events

(PID) Process:(2512) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2512) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
6
Suspicious files
4
Text files
646
Unknown types
2

Dropped files

PID
Process
Filename
Type
3808sm.exeC:\Users\admin\Desktop\sm\addons\jquery.tablesorter.pager.csstext
MD5:1203093A602BC936C390178FF7A46A5C
SHA256:C04CE44EF4AAC2D951A2AAAE6475ECEF9C0920033F51C018ECD0928FCC5821B8
3808sm.exeC:\Users\admin\Desktop\sm\js\jquery.jqplot.min.csstext
MD5:0CADA2AB04C29A5AAB284EF0DDE3EE7B
SHA256:545A037F9F71878C86F24717F975CBEA5943A8FB7A17E3C9E9D138B076F59505
3808sm.exeC:\Users\admin\Desktop\sm\index.csstext
MD5:DD85DEE1994DBA25BCDF0730858D31BE
SHA256:2875F4FEC85C8E42D81C429C81B5271BA03BB1234828BC471E6FB9990AF068D0
3808sm.exeC:\Users\admin\Desktop\sm\modules\domain_searcher.txttext
MD5:65C924D08C3C763972BCE2FEA2EFF4BA
SHA256:2F70AAA12AC643BA4E904C75EC6F297D71EB34D1A87CDF8B04A4C5570B8FCA2A
3808sm.exeC:\Users\admin\Desktop\sm\js\jquery.qtip.min.csstext
MD5:D5215FC06AC118B059861113810733AB
SHA256:431BF9559EF974B2A640C13A3005CA74EE41B8E70D877F5A7ACDB43B607AC18D
3808sm.exeC:\Users\admin\Desktop\sm\modules\framer.txthtml
MD5:9009C7ED786B8EF3C139DE5A8A0EAB74
SHA256:80A6A71CE02EDEAABA0494BB8045B586AC97CAB32CA5341DB8A498ACDE7FC84A
3808sm.exeC:\Users\admin\Desktop\sm\modules\htacess.txttext
MD5:A42E87971C7BFB30EFBE46C52B04CCF7
SHA256:188AB2C4594CB0E7399D0D61C60A1FBD15606FFF456AD4F6E7ABE8DB28E6719A
2512WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2512.39685\sm\sm.exeexecutable
MD5:9EF24A363F987F4B6CFA139A0107ECE5
SHA256:C7EA0644D09AD3D5909FEEA3952BF9DB1DBF23B7111471C6AA09E7FBECA1F5F9
3808sm.exeC:\Users\admin\Desktop\sm\css\theme.blue.csstext
MD5:B08C8D912B9078339052DF4E8BB3C863
SHA256:D48AD031D4477EF2BFD81DFEB962A8C1D6C55594033D78799DA4EA9694D47A1E
3808sm.exeC:\Users\admin\Desktop\sm\css\ui-darkness\jquery-ui-1.8.23.custom.csstext
MD5:A9E6E8F37B322C1839BF3A1D509DA5DA
SHA256:62401C0C9D08160DE0D91133A7FBB7E5AC68F772407D1916545236C59F565820
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
sm.rar