File name:

sam.exe

Full analysis: https://app.any.run/tasks/2edf1f6a-7edc-4495-8d95-9f582a3cd2ed
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 24, 2024, 10:37:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AFBB1E6F834B6EDA67A86BE6EEA15623

SHA1:

4F76E50313856519E51B22D09FACA9C008061067

SHA256:

C264E64CB744015532A4E1DCDBED814CC4850E1918C257EA9046A4665B481185

SSDEEP:

6144:6Gpk2RdybmWoFAy01EPTMiX5ZNKWOPkKSmar1IZya:6cdQmtKEPIiJWWOPBSmarE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RANSOMWARE has been detected

      • sam.exe (PID: 6752)

    • Starts CMD.EXE for self-deleting

      • sam.exe (PID: 6752)

    • Renames files like ransomware

      • sam.exe (PID: 6752)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sam.exe (PID: 6384)
      • ShellExperienceHost.exe (PID: 6224)
      • sam.exe (PID: 6752)

    • Starts CMD.EXE for commands execution

      • sam.exe (PID: 6384)
      • sam.exe (PID: 6752)

    • The executable file from the user directory is run by the CMD process

      • sam.exe (PID: 6752)

    • Creates file in the systems drive root

      • sam.exe (PID: 6752)

    • Write to the desktop.ini file (may be used to cloak folders)

      • sam.exe (PID: 6752)

    • Hides command output

      • cmd.exe (PID: 6392)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6392)

  • INFO

    • Checks supported languages

      • sam.exe (PID: 6384)
      • ShellExperienceHost.exe (PID: 6224)
      • sam.exe (PID: 6752)

    • Reads the computer name

      • sam.exe (PID: 6384)
      • sam.exe (PID: 6752)
      • ShellExperienceHost.exe (PID: 6224)

    • The process uses the downloaded file

      • sam.exe (PID: 6384)
      • sam.exe (PID: 6752)

    • Process checks computer location settings

      • sam.exe (PID: 6384)
      • sam.exe (PID: 6752)

    • Manual execution by a user

      • notepad.exe (PID: 3144)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 3144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:08:15 16:39:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 93184
InitializedDataSize: 41472
UninitializedDataSize: -
EntryPoint: 0x7620
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sam.exe no specs cmd.exe conhost.exe no specs THREAT sam.exe no specs shellexperiencehost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3144"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\How To Restore Your Files.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5964PING -n 5 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6224"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
6384"C:\Users\admin\AppData\Local\Temp\sam.exe" C:\Users\admin\AppData\Local\Temp\sam.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6392"C:\WINDOWS\system32\cmd.exe" /c PING -n 5 127.0.0.1 > NUL && del "C:\Users\admin\AppData\Local\Temp\sam.exe"C:\Windows\SysWOW64\cmd.exe—sam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6692"C:\WINDOWS\SysWOW64\cmd.exe" /c ECHO "You must restart the program to resolve a critical error" && start "" "C:\Users\admin\AppData\Local\Temp\sam.exe"C:\Windows\SysWOW64\cmd.exe
sam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6704\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6752"C:\Users\admin\AppData\Local\Temp\sam.exe" C:\Users\admin\AppData\Local\Temp\sam.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sam.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
2 352
Read events
2 346
Write events
6
Delete events
0

Modification events

(PID) Process:(6224) ShellExperienceHost.exeKey:\REGISTRY\A\{d4de5515-5fdc-1857-588d-1e60d20af071}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000002856F3D1EF55DB01
(PID) Process:(6224) ShellExperienceHost.exeKey:\REGISTRY\A\{d4de5515-5fdc-1857-588d-1e60d20af071}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000C47AA5D5EF55DB01
(PID) Process:(6224) ShellExperienceHost.exeKey:\REGISTRY\A\{d4de5515-5fdc-1857-588d-1e60d20af071}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000001A56A6D5EF55DB01
(PID) Process:(6224) ShellExperienceHost.exeKey:\REGISTRY\A\{d4de5515-5fdc-1857-588d-1e60d20af071}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000009D4547D9EF55DB01
(PID) Process:(6224) ShellExperienceHost.exeKey:\REGISTRY\A\{d4de5515-5fdc-1857-588d-1e60d20af071}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000CDCF47D9EF55DB01
Executable files
2
Suspicious files
162
Text files
80
Unknown types
0

Dropped files

PID
Process
Filename
Type
6752sam.exe\\?\Volume{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}\Recovery\WindowsRE\Winre.wim —
MD5:—
SHA256:—
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\Recovery\WindowsRE\Winre.wim —
MD5:—
SHA256:—
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\Recovery\WindowsRE\Winre.wim.C4AA509138FF7B1E1E0E0F23652C68B82232B78CE9F686D938F844345FB25D1A —
MD5:—
SHA256:—
6752sam.exe\\?\Volume{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}\Recovery\WindowsRE\Winre.wim.DA35AE4549681F9B3A622939B7AB768D9CF250D2B830DD4031A59B2C90E66950 —
MD5:—
SHA256:—
6752sam.exe\\?\Volume{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}\Recovery\WindowsRE\ReAgent.xmlbinary
MD5:D2DE9C09D41AD9A97E298F5F0859306F
SHA256:818C86C3121DD5B0576883A595BA2B20F570495D1D0BC67E0F9DF3D428060439
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\Recovery\WindowsRE\ReAgent.xmlbinary
MD5:C081F96F48BCAE274DAB3CD143BED617
SHA256:FE04E8E7CC5ADB39C7CA793D949EADEB794B291EE7B1645C9617B175C00F6E6E
6752sam.exe\\?\Volume{eaf65672-68c3-4f99-8d5c-104b5f4d8fff}\Recovery\WindowsRE\boot.sdibinary
MD5:2E3B47B9906E48DD125054A49CF11A63
SHA256:8CB0D004644F3EDD4EECD2E5C27D13A04144D121ECDFCDDBF0DB259C1D0EE0EC
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\Recovery\How To Restore Your Files.txttext
MD5:D03B7C3AB3B7CAF67542605C62A0117B
SHA256:E6761951D3EA4B2E31719E9F1F30D008125B333B225D1EEFE16ECAAEB8ACD48B
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\How To Restore Your Files.txttext
MD5:D03B7C3AB3B7CAF67542605C62A0117B
SHA256:E6761951D3EA4B2E31719E9F1F30D008125B333B225D1EEFE16ECAAEB8ACD48B
6752sam.exe\\?\Volume{2f5c5e73-85a9-11eb-90a8-9a9b76358421}\Recovery\WindowsRE\boot.sdi.C6B9C8015EACC06B92D459C2338F72320ABD660DC123B5EA191A0077D810C36Abinary
MD5:93C6703B8892977742A7B9B769269B99
SHA256:9C3B8BE98FF4842A754C40C3A3432DEC613FB08F1CA570DDDC940D39B5736B1E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
32
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6600
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6756
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6756
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
2.19.120.29:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2624
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.19.120.29
  • 2.19.120.21
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 2.23.181.156
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.64
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.2
  • 40.126.31.73
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sam.exe