File name:

pw-free-online.exe

Full analysis: https://app.any.run/tasks/f74d5e13-19ff-4960-96cf-eb03c5add841
Verdict: Malicious activity
Analysis date: March 11, 2024, 22:14:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B00F4EF87125599AE72DEF4555E48175

SHA1:

8B1073B0CEC1D85A6CA39842E43C8A9F49526953

SHA256:

BC917C4424C078290C3CBBB13E5F2F9C2939222D058D70056688718AE33E13A9

SSDEEP:

98304:UkL2991YngbfnLTccGEE7kc7EF2DKlVcu/xI9Gu1:j2991OgDtQIc7E4Wcu/xI911

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pw-free-online.exe (PID: 3536)
      • pw-free-online.exe (PID: 3932)
      • pw-free-online.tmp (PID: 3304)
      • SmDownloader.exe (PID: 4004)
      • pw-demo-pack-for-freesetup.exe (PID: 3684)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pw-free-online.exe (PID: 3536)
      • pw-free-online.exe (PID: 3932)
      • pw-free-online.tmp (PID: 3304)
      • SmDownloader.exe (PID: 4004)
      • pw-demo-pack-for-freesetup.exe (PID: 3684)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Reads the Windows owner or organization settings

      • pw-free-online.tmp (PID: 3304)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Uses TASKKILL.EXE to kill process

      • pw-free-online.tmp (PID: 3304)

    • Process drops legitimate windows executable

      • pw-free-online.tmp (PID: 3304)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Reads the Internet Settings

      • pw-free-online.tmp (PID: 3304)

    • The process drops C-runtime libraries

      • pw-free-online.tmp (PID: 3304)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Reads security settings of Internet Explorer

      • pw-free-online.tmp (PID: 3304)

    • Drops 7-zip archiver for unpacking

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Changes Internet Explorer settings (feature browser emulation)

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Non-standard symbols in registry

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Drops a system driver (possible attempt to evade defenses)

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

  • INFO

    • Checks supported languages

      • pw-free-online.exe (PID: 3536)
      • pw-free-online.tmp (PID: 3972)
      • pw-free-online.exe (PID: 3932)
      • pw-free-online.tmp (PID: 3304)
      • SmDownloader.exe (PID: 4004)
      • pw-demo-pack-for-freesetup.exe (PID: 3684)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)
      • SmDownloader.exe (PID: 3392)

    • Reads the computer name

      • pw-free-online.tmp (PID: 3972)
      • pw-free-online.tmp (PID: 3304)
      • SmDownloader.exe (PID: 4004)
      • SmDownloader.exe (PID: 3392)
      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Create files in a temporary directory

      • pw-free-online.exe (PID: 3536)
      • pw-free-online.exe (PID: 3932)
      • pw-free-online.tmp (PID: 3304)
      • pw-demo-pack-for-freesetup.exe (PID: 3684)
      • SmDownloader.exe (PID: 3392)
      • SmDownloader.exe (PID: 4004)

    • Creates files in the program directory

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)

    • Creates a software uninstall entry

      • pw-demo-pack-for-freesetup.tmp (PID: 2372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 406016
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 12.8.0.0
ProductVersionNumber: 12.8.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: MiniTool Software Limited
FileDescription: MiniTool Partition Wizard Setup
FileVersion: 12.8
LegalCopyright: Copyright © 2023 MiniTool Software Limited, all rights reserved.
OriginalFileName:
ProductName: MiniTool Partition Wizard
ProductVersion: 12.8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
9
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pw-free-online.exe pw-free-online.tmp no specs pw-free-online.exe pw-free-online.tmp taskkill.exe no specs smdownloader.exe smdownloader.exe pw-demo-pack-for-freesetup.exe pw-demo-pack-for-freesetup.tmp

Process information

PID
CMD
Path
Indicators
Parent process
864"taskkill.exe" /f /im "updatechecker.exe"C:\Windows\System32\taskkill.exe—pw-free-online.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2372"C:\Users\admin\AppData\Local\Temp\is-V7L6Q.tmp\pw-demo-pack-for-freesetup.tmp" /SL5="$90292,28212041,488960,C:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exe" /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=spanishC:\Users\admin\AppData\Local\Temp\is-V7L6Q.tmp\pw-demo-pack-for-freesetup.tmp
pw-demo-pack-for-freesetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-v7l6q.tmp\pw-demo-pack-for-freesetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3304"C:\Users\admin\AppData\Local\Temp\is-9IUBC.tmp\pw-free-online.tmp" /SL5="$100130,2294223,1148928,C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" /SPAWNWND=$18013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\is-9IUBC.tmp\pw-free-online.tmp
pw-free-online.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-9iubc.tmp\pw-free-online.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3392"C:\Users\admin\AppData\Local\Temp\is-20983.tmp\SmDownloader.exe" /HWND:1311034 /PATH:"C:\Program Files\MiniTool Partition Wizard 12\..\MiniTool ShadowMaker" /URL:https://www.partitionwizard.com/download/online-setup-config/pwfree-v12-bundle-sm.ini /VERYSILENT /USERMSG:1439 /LANG:spanishC:\Users\admin\AppData\Local\Temp\is-20983.tmp\SmDownloader.exe
pw-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-20983.tmp\smdownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-20983.tmp\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
3536"C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" C:\Users\admin\AppData\Local\Temp\pw-free-online.exe
explorer.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
MEDIUM
Description:
MiniTool Partition Wizard Setup
Exit code:
0
Version:
12.8
Modules
Images
c:\users\admin\appdata\local\temp\pw-free-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3684C:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exe /VERYSILENT /DIR="C:\Program Files\MiniTool Partition Wizard 12" /LANG=spanishC:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exe
SmDownloader.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
MiniTool Partition Wizard DEMO Setup
Exit code:
0
Version:
12.8
Modules
Images
c:\users\admin\appdata\local\temp\pw-demo-pack-for-freesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3932"C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" /SPAWNWND=$18013E /NOTIFYWND=$E0170 C:\Users\admin\AppData\Local\Temp\pw-free-online.exe
pw-free-online.tmp
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
HIGH
Description:
MiniTool Partition Wizard Setup
Exit code:
0
Version:
12.8
Modules
Images
c:\users\admin\appdata\local\temp\pw-free-online.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3972"C:\Users\admin\AppData\Local\Temp\is-U8A4H.tmp\pw-free-online.tmp" /SL5="$E0170,2294223,1148928,C:\Users\admin\AppData\Local\Temp\pw-free-online.exe" C:\Users\admin\AppData\Local\Temp\is-U8A4H.tmp\pw-free-online.tmp—pw-free-online.exe
User:
admin
Company:
MiniTool Software Limited
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-u8a4h.tmp\pw-free-online.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4004"C:\Users\admin\AppData\Local\Temp\is-20983.tmp\SmDownloader.exe" /HWND:1311034 /PATH:"C:\Program Files\MiniTool Partition Wizard 12" /URL:https://www.partitionwizard.com/download/online-setup-config/pwpro-v12.ini /VERYSILENT /USERMSG:1450 /LANG:spanishC:\Users\admin\AppData\Local\Temp\is-20983.tmp\SmDownloader.exe
pw-free-online.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-20983.tmp\smdownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\is-20983.tmp\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
Total events
6 748
Read events
6 699
Write events
43
Delete events
6

Modification events

(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E80C0000D0F9937D0174DA01
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
3F9E9089EE07E149C1D1832E74854736BA667543E311203CFCF48BFDE8FFACFB
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3304) pw-free-online.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2372) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
44090000847DC89D0174DA01
(PID) Process:(2372) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
81B144569CE20E0B4DD9F7813FED9D149F4B42063689C9C5D756CA2676BAF727
(PID) Process:(2372) pw-demo-pack-for-freesetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
Executable files
158
Suspicious files
102
Text files
24
Unknown types
43

Dropped files

PID
Process
Filename
Type
3536pw-free-online.exeC:\Users\admin\AppData\Local\Temp\is-U8A4H.tmp\pw-free-online.tmpexecutable
MD5:38088568F4393EDC27739E4E3B3B157A
SHA256:398B1FE38A434790F6D5E82D72BBAEF3B3DFBA13740BDE388FB7749312C1B917
3932pw-free-online.exeC:\Users\admin\AppData\Local\Temp\is-9IUBC.tmp\pw-free-online.tmpexecutable
MD5:38088568F4393EDC27739E4E3B3B157A
SHA256:398B1FE38A434790F6D5E82D72BBAEF3B3DFBA13740BDE388FB7749312C1B917
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\unsupport.bmpimage
MD5:4AC29DE505CFB25BBB88D190AD379D82
SHA256:93A93EC1F9AF7118B2FB05A1ABC420781130E5663B92536A23EC6A4B172A0843
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\msvcp120.dllexecutable
MD5:A883C95684EFF25E71C3B644912C73A5
SHA256:D672FB07A05FB53CC821DA0FDE823FDFD46071854FE8C6C5EA83D7450B978ECB
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\SmDownloader.exeexecutable
MD5:0BB1BE1CEE6BC878ACBB41B1AF7CFC88
SHA256:166960F92A85A33207DAD124FEA1938740A82809C05DD449FD19F39C2C029038
4004SmDownloader.exeC:\Users\admin\AppData\Local\Temp\pw-demo-pack-for-freesetup.exeexecutable
MD5:8B03A3617BE67B9BBC9AD2512B529DC6
SHA256:8C70805D61F4C602F93A65FF4BA016939E5C707F0AA9E4451E354D0E3FA3F6C4
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\pwbmp.bmpimage
MD5:C4C50E455CB11D349A5200508F2F7D4F
SHA256:BA68E855CE14DAF9B319E3BA91199FE504804EC58080B722686AAA2CCDE9EF38
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\pwpro.bmpimage
MD5:91B84953535C8E68D9B8180AE60FF0CE
SHA256:10C9CF3C6885E339A7C9C4808716A7FDE113B4C4EE93FB2D5393240DF2D206B6
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\line.bmpimage
MD5:9DC5BF6E4B2CAD053D12AD24260D9327
SHA256:EFB22F0B990C4ED4A8D36868C7D9D3793B61F0728343306CAEAE0AE5F0751447
3304pw-free-online.tmpC:\Users\admin\AppData\Local\Temp\is-20983.tmp\support.bmpimage
MD5:12CA16A9C8707B7F0A257E6CABBBEA3A
SHA256:624677996B347CD36593D4A1107B265C903268086F2F548B50C0F329FD649A33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
12
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
unknown
4004
SmDownloader.exe
104.18.21.161:443
www.partitionwizard.com
CLOUDFLARENET
—
unknown
3392
SmDownloader.exe
104.18.20.161:443
www.partitionwizard.com
CLOUDFLARENET
—
unknown
3392
SmDownloader.exe
104.18.21.178:443
cdn2.minitool.com
CLOUDFLARENET
—
unknown
4004
SmDownloader.exe
104.18.21.178:443
cdn2.minitool.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.partitionwizard.com
  • 104.18.20.161
  • 104.18.21.161
unknown
cdn2.minitool.com
  • 104.18.21.178
  • 104.18.20.178
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pw-free-online.exe