File name:

pw-free-online

Full analysis: https://app.any.run/tasks/e6aec96d-0cc9-482e-be2e-cec7d6c22f3c
Verdict: Malicious activity
Analysis date: January 16, 2024, 04:35:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B00F4EF87125599AE72DEF4555E48175

SHA1:

8B1073B0CEC1D85A6CA39842E43C8A9F49526953

SHA256:

BC917C4424C078290C3CBBB13E5F2F9C2939222D058D70056688718AE33E13A9

SSDEEP:

98304:UkL2991YngbfnLTccGEE7kc7EF2DKlVcu/xI9Gu1:j2991OgDtQIc7E4Wcu/xI911

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pw-free-online.tmp (PID: 268)
      • pw-free-online.exe (PID: 492)
      • pw-free-online.exe (PID: 128)
      • SmDownloader.exe (PID: 696)
      • pw-demo-pack-for-freesetup.exe (PID: 2384)
      • pw_sm_setup_x86.exe (PID: 2404)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • pw-free-online.tmp (PID: 268)
      • pw_sm_setup_x86.tmp (PID: 1036)

    • Executable content was dropped or overwritten

      • pw-free-online.exe (PID: 492)
      • pw-free-online.exe (PID: 128)
      • pw-free-online.tmp (PID: 268)
      • SmDownloader.exe (PID: 696)
      • pw-demo-pack-for-freesetup.exe (PID: 2384)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)
      • pw_sm_setup_x86.exe (PID: 2404)

    • Process drops legitimate windows executable

      • pw-free-online.tmp (PID: 268)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)

    • The process drops C-runtime libraries

      • pw-free-online.tmp (PID: 268)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)

    • Reads the Windows owner or organization settings

      • pw-free-online.tmp (PID: 268)
      • pw_sm_setup_x86.tmp (PID: 1036)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)

    • Reads the Internet Settings

      • pw-free-online.tmp (PID: 268)

    • Drops 7-zip archiver for unpacking

      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)

    • Drops a system driver (possible attempt to evade defenses)

      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)

  • INFO

    • Create files in a temporary directory

      • pw-free-online.exe (PID: 492)
      • pw-free-online.exe (PID: 128)
      • pw-free-online.tmp (PID: 268)
      • SmDownloader.exe (PID: 1832)
      • SmDownloader.exe (PID: 696)
      • pw_sm_setup_x86.exe (PID: 2404)
      • pw-demo-pack-for-freesetup.exe (PID: 2384)

    • Checks supported languages

      • pw-free-online.tmp (PID: 268)
      • pw-free-online.exe (PID: 492)
      • pw-free-online.tmp (PID: 1776)
      • pw-free-online.exe (PID: 128)
      • SmDownloader.exe (PID: 1832)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • pw_sm_setup_x86.tmp (PID: 1036)
      • SmDownloader.exe (PID: 696)
      • pw_sm_setup_x86.exe (PID: 2404)
      • pw-demo-pack-for-freesetup.exe (PID: 2384)

    • Reads the computer name

      • pw-free-online.tmp (PID: 268)
      • pw-free-online.tmp (PID: 1776)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
      • SmDownloader.exe (PID: 1832)
      • pw_sm_setup_x86.tmp (PID: 1036)
      • SmDownloader.exe (PID: 696)

    • Creates files in the program directory

      • pw_sm_setup_x86.tmp (PID: 1036)
      • pw-demo-pack-for-freesetup.tmp (PID: 2192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 18:10:23+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 406016
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 12.8.0.0
ProductVersionNumber: 12.8.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: MiniTool Software Limited
FileDescription: MiniTool Partition Wizard Setup
FileVersion: 12.8
LegalCopyright: Copyright © 2023 MiniTool Software Limited, all rights reserved.
OriginalFileName:
ProductName: MiniTool Partition Wizard
ProductVersion: 12.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
13
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pw-free-online.exe pw-free-online.tmp no specs pw-free-online.exe pw-free-online.tmp taskkill.exe no specs smdownloader.exe smdownloader.exe pw-demo-pack-for-freesetup.exe pw-demo-pack-for-freesetup.tmp pw_sm_setup_x86.exe pw_sm_setup_x86.tmp taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" C:\Users\admin\AppData\Local\Temp\pw-free-online.exe
explorer.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
MEDIUM
Description:
MiniTool Partition Wizard Setup
Exit code:
0
Version:
12.8
Modules
Images
c:\users\admin\appdata\local\temp\pw-free-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
268"C:\Users\admin\AppData\Local\Temp\is-QNR2L.tmp\pw-free-online.tmp" /SL5="$501AC,2294223,1148928,C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\is-QNR2L.tmp\pw-free-online.tmp
pw-free-online.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qnr2l.tmp\pw-free-online.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
492"C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\pw-free-online.exe
pw-free-online.tmp
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
MiniTool Partition Wizard Setup
Exit code:
0
Version:
12.8
Modules
Images
c:\users\admin\appdata\local\temp\pw-free-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
696"C:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\SmDownloader.exe" /HWND:328086 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwpro-v12.ini /VERYSILENT /USERMSG:1450 /LANG:englishC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\SmDownloader.exe
pw-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-bvnh3.tmp\smdownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-bvnh3.tmp\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
1036"C:\Users\admin\AppData\Local\Temp\is-GPK4R.tmp\pw_sm_setup_x86.tmp" /SL5="$20212,184582230,268800,C:\Users\admin\AppData\Local\Temp\pw_sm_setup_x86.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /LANG=englishC:\Users\admin\AppData\Local\Temp\is-GPK4R.tmp\pw_sm_setup_x86.tmp
pw_sm_setup_x86.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-gpk4r.tmp\pw_sm_setup_x86.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1344"taskkill.exe" /f /im "updatechecker.exe"C:\Windows\System32\taskkill.exe—pw-free-online.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1572"taskkill.exe" /f /im "SchedulerService.exe"C:\Windows\System32\taskkill.exe—pw_sm_setup_x86.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1776"C:\Users\admin\AppData\Local\Temp\is-HI3IS.tmp\pw-free-online.tmp" /SL5="$301AA,2294223,1148928,C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" C:\Users\admin\AppData\Local\Temp\is-HI3IS.tmp\pw-free-online.tmp—pw-free-online.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hi3is.tmp\pw-free-online.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1832"C:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\SmDownloader.exe" /HWND:328086 /PATH:"C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12-bundle-sm.ini /VERYSILENT /USERMSG:1439 /LANG:englishC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\SmDownloader.exe
pw-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-bvnh3.tmp\smdownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-bvnh3.tmp\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
2192"C:\Users\admin\AppData\Local\Temp\is-JH4T9.tmp\pw-demo-pack-for-freesetup.tmp" /SL5="$301A8,28212041,488960,C:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=englishC:\Users\admin\AppData\Local\Temp\is-JH4T9.tmp\pw-demo-pack-for-freesetup.tmp
pw-demo-pack-for-freesetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jh4t9.tmp\pw-demo-pack-for-freesetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 550
Read events
2 536
Write events
8
Delete events
6

Modification events

(PID) Process:(268) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(268) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(268) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(268) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:RegFilesHash
Value:
3338452160800F9BC58DF72FF524DF76D7ADF2368DC25CC5F948F0B825DB7A75
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:RegFiles0000
Value:
C:\Program Files\MiniTool Partition Wizard 12\7-zip.dll
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:SessionHash
Value:
E7CD9E73729383428017149AECBAEB8F3F0EBBA825401023795C675FF9FC4CDB
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:Owner
Value:
900800002637D0A53548DA01
(PID) Process:(2192) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete keyName:(default)
Value:
Executable files
648
Suspicious files
781
Text files
1 390
Unknown types
16

Dropped files

PID
Process
Filename
Type
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\unsupport.bmpimage
MD5:4AC29DE505CFB25BBB88D190AD379D82
SHA256:93A93EC1F9AF7118B2FB05A1ABC420781130E5663B92536A23EC6A4B172A0843
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\support.bmpimage
MD5:12CA16A9C8707B7F0A257E6CABBBEA3A
SHA256:624677996B347CD36593D4A1107B265C903268086F2F548B50C0F329FD649A33
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\SmDownloader.exeexecutable
MD5:0BB1BE1CEE6BC878ACBB41B1AF7CFC88
SHA256:166960F92A85A33207DAD124FEA1938740A82809C05DD449FD19F39C2C029038
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\line.bmpimage
MD5:9DC5BF6E4B2CAD053D12AD24260D9327
SHA256:EFB22F0B990C4ED4A8D36868C7D9D3793B61F0728343306CAEAE0AE5F0751447
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\pwpro.bmpimage
MD5:91B84953535C8E68D9B8180AE60FF0CE
SHA256:10C9CF3C6885E339A7C9C4808716A7FDE113B4C4EE93FB2D5393240DF2D206B6
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\msvcp120.dllexecutable
MD5:A883C95684EFF25E71C3B644912C73A5
SHA256:D672FB07A05FB53CC821DA0FDE823FDFD46071854FE8C6C5EA83D7450B978ECB
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\ssleay32.dllexecutable
MD5:A37A743CE2876ED4E44C3380ABEB432C
SHA256:5CC128D942186A08E7CCFED719154DC5DE1E1BB5FE1D952F592C9BF2E1A978C6
128pw-free-online.exeC:\Users\admin\AppData\Local\Temp\is-HI3IS.tmp\pw-free-online.tmpexecutable
MD5:38088568F4393EDC27739E4E3B3B157A
SHA256:398B1FE38A434790F6D5E82D72BBAEF3B3DFBA13740BDE388FB7749312C1B917
268pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-BVNH3.tmp\msvcr120.dllexecutable
MD5:2FB20C782C237F8B23DF112326048479
SHA256:E0305AA54823E6F39D847F8B651B7BD08C085F1DBBCB5C3C1CE1942C0FA1E9FA
696SmDownloader.exeC:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exeexecutable
MD5:8B03A3617BE67B9BBC9AD2512B529DC6
SHA256:8C70805D61F4C602F93A65FF4BA016939E5C707F0AA9E4451E354D0E3FA3F6C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
14
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1832
SmDownloader.exe
104.18.20.161:443
www.partitionwizard.com
CLOUDFLARENET
—
unknown
696
SmDownloader.exe
104.18.20.161:443
www.partitionwizard.com
CLOUDFLARENET
—
unknown
1832
SmDownloader.exe
104.18.20.178:443
cdn2.minitool.com
CLOUDFLARENET
—
unknown
696
SmDownloader.exe
104.18.20.178:443
cdn2.minitool.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.partitionwizard.com
  • 104.18.20.161
  • 104.18.21.161
unknown
cdn2.minitool.com
  • 104.18.20.178
  • 104.18.21.178
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pw-free-online