| File name: | smartscreen_protected.exe |
| Full analysis: | https://app.any.run/tasks/28ed0900-d188-46e6-ada4-b8eeacdd980a |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 27, 2024, 23:11:08 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 713B1C97B09D0E633EDE2F62556E78B9 |
| SHA1: | C67835CA9504049A350FDB023EC7975CCCCE1674 |
| SHA256: | C33ACAB1DDBEE95302F0D54FEB1C49C40DEC807CEC251FB6D30D056F571155E0 |
| SSDEEP: | 98304:29yJKnUbDGauKYNY7fdSmgy3p+2aEcwygZgiM+PztrzHqFTJPL9nEQmxqkXYhbi2:dbK |
MALICIOUS
Drops the executable file immediately after the start
- runas.exe (PID: 2632)
- smartscreen_protected.exe (PID: 900)
Renames files like ransomware
- smartscreen_protected.exe (PID: 900)
Steals credentials from Web Browsers
- smartscreen_protected.exe (PID: 900)
Actions looks like stealing of personal data
- smartscreen_protected.exe (PID: 900)
SUSPICIOUS
Reads the BIOS version
- smartscreen_protected.exe (PID: 2760)
- smartscreen_protected.exe (PID: 900)
- smartscreen_protected.exe (PID: 1576)
- smartscreen_protected.exe (PID: 3756)
Reads the Internet Settings
- Magicmida.exe (PID: 1860)
- Magicmida.exe (PID: 3372)
Write to the desktop.ini file (may be used to cloak folders)
- smartscreen_protected.exe (PID: 900)
Creates files like ransomware instruction
- smartscreen_protected.exe (PID: 900)
Reads browser cookies
- smartscreen_protected.exe (PID: 900)
INFO
Checks supported languages
- smartscreen_protected.exe (PID: 2760)
- Magicmida.exe (PID: 2780)
- smartscreen_protected.exe (PID: 900)
- smartscreen_protected.exe (PID: 1576)
- Magicmida.exe (PID: 1860)
- Magicmida.exe (PID: 3372)
- smartscreen_protected.exe (PID: 3756)
Reads the computer name
- smartscreen_protected.exe (PID: 900)
- Magicmida.exe (PID: 2780)
- Magicmida.exe (PID: 1860)
- Magicmida.exe (PID: 3372)
Manual execution by a user
- WinRAR.exe (PID: 2572)
- smartscreen_protected.exe (PID: 900)
- Magicmida.exe (PID: 1860)
- Magicmida.exe (PID: 3372)
Drops the executable file immediately after the start
- WinRAR.exe (PID: 2572)
Reads the machine GUID from the registry
- Magicmida.exe (PID: 1860)
- smartscreen_protected.exe (PID: 900)
- Magicmida.exe (PID: 3372)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2572)
Creates files or folders in the user directory
- smartscreen_protected.exe (PID: 900)
Create files in a temporary directory
- smartscreen_protected.exe (PID: 900)
Dropped object may contain TOR URL's
- smartscreen_protected.exe (PID: 900)
Process checks whether UAC notifications are on
- smartscreen_protected.exe (PID: 3756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| Subsystem: | Windows GUI |
|---|---|
| SubsystemVersion: | 6 |
| ImageVersion: | - |
| OSVersion: | 6 |
| EntryPoint: | 0x4c8058 |
| UninitializedDataSize: | - |
| InitializedDataSize: | 147456 |
| CodeSize: | 335872 |
| LinkerVersion: | 14.37 |
| PEType: | PE32 |
| ImageFileCharacteristics: | Executable, 32-bit |
| TimeStamp: | 2023:12:01 10:10:33+01:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
56
Monitored processes
9
Malicious processes
1
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2632 | "C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\Desktop\smartscreen_protected.exe | C:\Windows\System32\runas.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Run As Utility Exit code: 3221225786 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2572 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Magicmida.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2780 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2572.7880\Magicmida.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2572.7880\Magicmida.exe | — | WinRAR.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1860 | "C:\Users\admin\Desktop\Magicmida.exe" | C:\Users\admin\Desktop\Magicmida.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 1576 | "C:\Users\admin\Desktop\smartscreen_protected.exe" | C:\Users\admin\Desktop\smartscreen_protected.exe | — | Magicmida.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2760 | "C:\Users\admin\Desktop\smartscreen_protected.exe" | C:\Users\admin\Desktop\smartscreen_protected.exe | — | Magicmida.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 900 | "C:\Users\admin\Desktop\smartscreen_protected.exe" | C:\Users\admin\Desktop\smartscreen_protected.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 3372 | "C:\Users\admin\Desktop\Magicmida.exe" | C:\Users\admin\Desktop\Magicmida.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3756 | "C:\Users\admin\Desktop\smartscreen_protected.exe" | C:\Users\admin\Desktop\smartscreen_protected.exe | — | Magicmida.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
Total events
14 163
Read events
13 935
Write events
201
Delete events
27
Modification events
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2572) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
22
Suspicious files
1 166
Text files
832
Unknown types
16
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\F | abr | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\E | abr | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.ini | binary | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\B | binary | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\Users\admin\Pictures\francelocations.png.CBhwKBgQD | image | |
MD5:914231053594C503DCFC20ECDC21AD76 | SHA256:C1D5B8AAFB876F3D250F65481BBC17EDDBE9B7E38FBD462B8C59121533970EDD | |||
| 900 | smartscreen_protected.exe | C:\Users\admin\Pictures\CBhwKBgQD.README.txt | text | |
MD5:61C324611E6B2E1B180664F7A7982A7E | SHA256:CFAC38A276EA508DA50703915692CB8BD9D734CE74DC051239BEB68CF89B2B37 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\A | binary | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\D | abr | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
| 900 | smartscreen_protected.exe | C:\Users\admin\Videos\CBhwKBgQD.README.txt | text | |
MD5:61C324611E6B2E1B180664F7A7982A7E | SHA256:CFAC38A276EA508DA50703915692CB8BD9D734CE74DC051239BEB68CF89B2B37 | |||
| 900 | smartscreen_protected.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\G | abr | |
MD5:5F54D1240735D46980B776AF554F44D3 | SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |