File name: | OnePlus_USB_Drivers_Setup.exe |
Full analysis: | https://app.any.run/tasks/92f8eb4b-3e4f-40bf-b8fc-d90cd4cf16f0 |
Verdict: | Malicious activity |
Analysis date: | April 29, 2025, 21:06:20 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections |
MD5: | FCC1C5D31B2F3F63F90C43A26FBE2FCB |
SHA1: | E7A563DC885574A070FB58B356A8259279948912 |
SHA256: | 01CEF3F06745D6F505C254EBA4E1FE79821F922028613DA1D4A4A7E3D230AAA8 |
SSDEEP: | 196608:ftMCcM85soaqoRpR2MeBd1gKPK7i0Ft0Kmhz2vZgrKtNBZO6kBQ5I3BGhvjKfvww:d8uZqmB+0L0K9v4KtNBHkS5IYxeAAAv0 |
.exe | | | InstallShield setup (49.2) |
---|---|---|
.exe | | | Win32 Executable Delphi generic (16.2) |
.scr | | | Windows screen saver (14.9) |
.dll | | | Win32 Dynamic Link Library (generic) (7.5) |
.exe | | | Win32 Executable (generic) (5.1) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 1992:06:19 22:22:17+00:00 |
ImageFileCharacteristics: | Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
PEType: | PE32 |
LinkerVersion: | 2.25 |
CodeSize: | 148992 |
InitializedDataSize: | 50688 |
UninitializedDataSize: | - |
EntryPoint: | 0x25468 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.0.0.0 |
ProductVersionNumber: | 0.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Windows, Latin1 |
Comments: | - |
CompanyName: | OnePlus, Inc |
FileDescription: | OnePlus USB Drivers 1.00 Installation |
FileVersion: | 1.00 |
LegalCopyright: | OnePlus, Inc |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1764 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
7420 | "C:\Users\admin\AppData\Local\Temp\OnePlus_USB_Drivers_Setup.exe" | C:\Users\admin\AppData\Local\Temp\OnePlus_USB_Drivers_Setup.exe | — | explorer.exe | |||||||||||
User: admin Company: OnePlus, Inc Integrity Level: MEDIUM Description: OnePlus USB Drivers 1.00 Installation Exit code: 3221226540 Version: 1.00 Modules
| |||||||||||||||
7536 | "C:\Users\admin\AppData\Local\Temp\OnePlus_USB_Drivers_Setup.exe" | C:\Users\admin\AppData\Local\Temp\OnePlus_USB_Drivers_Setup.exe | explorer.exe | ||||||||||||
User: admin Company: OnePlus, Inc Integrity Level: HIGH Description: OnePlus USB Drivers 1.00 Installation Exit code: 0 Version: 1.00 Modules
| |||||||||||||||
7980 | "C:\Program Files (x86)\OnePlus USB Drivers\install_usbdrv.exe" | C:\Program Files (x86)\OnePlus USB Drivers\install_usbdrv.exe | — | OnePlus_USB_Drivers_Setup.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
7988 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | install_usbdrv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
8028 | C:\WINDOWS\system32\cmd.exe /c tool_amd64.exe /PATH . /LM /SW | C:\Windows\SysWOW64\cmd.exe | — | install_usbdrv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 2147549184 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
8036 | tool_amd64.exe /PATH . /LM /SW | C:\Program Files (x86)\OnePlus USB Drivers\tool_amd64.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Driver Package Installer Exit code: 2147549184 Version: 2.1 Modules
| |||||||||||||||
8100 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{0a1e013d-36d7-2b40-81d5-c2266cc2c7b3}\oneplus_android_winusb.inf" "9" "4a561c8df" "00000000000001D4" "WinSta0\Default" "00000000000001C0" "208" "c:\program files (x86)\oneplus usb drivers" | C:\Windows\System32\drvinst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 3758096971 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
8152 | C:\WINDOWS\system32\cmd.exe /c xcopy Android C:\Android\ /E /Y | C:\Windows\SysWOW64\cmd.exe | — | install_usbdrv.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
8160 | xcopy Android C:\Android\ /E /Y | C:\Windows\SysWOW64\xcopy.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Extended Copy Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | VersionMinor |
Value: 0 | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | Publisher |
Value: OnePlus, Inc | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | DisplayIcon |
Value: C:\Program Files (x86)\OnePlus USB Drivers\Uninstall.exe | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | UninstallString |
Value: C:\Program Files (x86)\OnePlus USB Drivers\Uninstall.exe | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | InstallDate |
Value: 20250429 | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | Language |
Value: 1033 | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | EstimatedSize |
Value: 19485 | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | NoModify |
Value: 1 | |||
(PID) Process: | (7536) OnePlus_USB_Drivers_Setup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\OnePlus USB Drivers 1.00 |
Operation: | write | Name: | NoRepair |
Value: 1 | |||
(PID) Process: | (8036) tool_amd64.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
Operation: | write | Name: | setupapi.dev.log |
Value: 4096 |
PID | Process | Filename | Type | |
---|---|---|---|---|
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp | — | |
MD5:— | SHA256:— | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Users\admin\AppData\Local\Temp\$inst\4.tmp | image | |
MD5:6244A657AC49B056D1BAD968BD1D7F47 | SHA256:E6595EFB3EB10B6251F584AD414EE951368990A94FC9E26F125215C406E5BC3E | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Users\admin\AppData\Local\Temp\$inst\2.tmp | compressed | |
MD5:1C10469E1F871D6FDA5CADB3209EF892 | SHA256:4E61FE857FF557A946CC0032A6A36468C893DEB1D12917161594406C72D76CF8 | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\amd64\WUDFUpdate_01009.dll | executable | |
MD5:CE2ECBEDCCE99AA4BD3907AA523A4190 | SHA256:CF88259BC68A7FE4B0F36662C5CDFF0449DA8F15E263D9EC2EB58B0C02D019AE | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Users\admin\AppData\Local\Temp\$inst\5.tmp | image | |
MD5:044A8488889F700428F37A441F497757 | SHA256:4B266FD2B4294B2275B4097BA9039D034F9F71976A1837B0EAA18CB69D747E71 | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\androidwinusb86.cat | binary | |
MD5:669061B62A32ACB4C53762249D00ED0A | SHA256:F91DE44AE4384B22594326B3063A86BF3D477ABF77499E46D2990DBF58D6771E | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\Android\fastboot.exe | executable | |
MD5:C886C47E19E8EDC768DC586C2B5F0FB1 | SHA256:94E378A560BB51858F2E5ADE15AF50F1256CE21A9E1F53EBCAD8719131158F62 | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\amd64\WdfCoInstaller01009.dll | executable | |
MD5:5315FC83C9CB743D91B916FC7D9A52EA | SHA256:D59C5AECF9781CBA0B5A5F03AF2DA60C8D4AD362BAF40DBAFA7F9B68967B41AB | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\Android\AdbWinApi.dll | executable | |
MD5:47A6EE3F186B2C2F5057028906BAC0C6 | SHA256:14A51482AA003DB79A400F4B15C158397FE6D57EE6606B3D633FA431A7BFDF4B | |||
7536 | OnePlus_USB_Drivers_Setup.exe | C:\Program Files (x86)\OnePlus USB Drivers\Android\adb.exe | executable | |
MD5:F70C698AD3E5B929B45DFC75D6DBC1FF | SHA256:8B2B8AD70D84907950BA681038C2D65DD8F054F92EA218F86863058A124298E9 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.29:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.29:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7208 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7208 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5392 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.29:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.216.77.29:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 40.126.31.1:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |